Examkin

Question

Difficulty: MediumSystem-Assigned and User-Assigned Managed Identities

You are designing a security architecture for three Azure Function apps that must retrieve database connection secrets from a single Azure Key Vault. The solution must use managed identities, minimize administrative overhead, and grant only the minimum permissions required to read the secrets.

Which two configuration steps should you perform?

  1. Create a single user-assigned managed identity and associate its resource ID with all three Function apps using the userAssignedIdentities configuration property.Answer
  2. B
    Enable a system-assigned managed identity on each of the three Function apps by setting the identity type property to SystemAssigned.
  3. Assign the Key Vault Secrets User role to the user-assigned managed identity at the Key Vault scope.Answer
  4. D
    Assign the Key Vault Reader role to the user-assigned managed identity at the Key Vault scope.

Answer

To implement the solution, you should create a single user-assigned managed identity, associate its resource ID with all three Function apps, and assign the Key Vault Secrets User role to this identity at the Key Vault scope.
A user-assigned managed identity is a standalone Azure resource with its own lifecycle. Because it is independent, it can be shared across multiple resources like the three Function apps. This reduces overhead since we only need to manage a single identity and configure permissions once on the Key Vault. The Key Vault Secrets User role is the minimum role required to retrieve the secret values.

Step-by-Step Solution

1
Determine the identity type that minimizes overhead for sharing access.
Select a user-assigned managed identity since it can be shared among multiple Function apps, requiring only one RBAC role assignment instead of three.
System-assigned identities cannot be shared across resources, which would lead to duplicate role assignments and increased management overhead.
2
Identify the minimum required RBAC role for reading secrets.
Select the Key Vault Secrets User role.
This role allows the identity to read secret values without granting permissions to manage the Key Vault itself.
3
Assign the selected role to the identity.
The user-assigned managed identity is granted Key Vault Secrets User access at the scope of the Key Vault.
This establishes authorization for the shared identity to pull database secrets securely.

Key Concept

User-Assigned Managed Identities and Least-Privilege RBAC Roles
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic