Examkin

Question

Difficulty: MediumImplement Azure Event Hubs Solutions

An online retail inventory application is hosted on an Azure Virtual Machine (VM) and uses a C# worker service with the Azure.Messaging.EventHubs.Processor library to consume messages from an Azure Event Hub. The application uses a system-assigned managed identity to authenticate and utilizes an Azure Blob Storage container as a checkpoint store for partition load balancing. When the service starts up, it connects to the Event Hub successfully but fails to process partitions, throwing an error indicating that it is unauthorized to perform operations on the blob checkpoint container. You need to configure the minimal permissions required to allow the EventProcessorClient to initialize, manage partition leases, and write checkpoints. Which of the following actions should you perform?

  1. Assign the Storage Blob Data Contributor role to the VM's system-assigned managed identity at the scope of the checkpoint blob container.Answer
  2. B
    Assign the Storage Blob Data Reader role to the VM's system-assigned managed identity, and configure the application to manually manage lease updates via the Blob SDK.
  3. C
    Create a new user-assigned managed identity with the Reader role on the storage account, assign it to the VM, and configure the EventProcessorClient to use it.
  4. D
    Grant GET and LIST secrets permissions to the VM's system-assigned managed identity in the Key Vault access policies to retrieve a shared access signature (SAS) token for the storage container.

Answer

Assign the Storage Blob Data Contributor role to the VM's system-assigned managed identity at the scope of the checkpoint blob container.
The correct answer is to assign the Storage Blob Data Contributor role to the VM's system-assigned managed identity at the scope of the checkpoint blob container. The EventProcessorClient uses Azure Blob Storage as a collaborative coordinator to distribute partitions dynamically and record progress (checkpointing). This process requires the client to create blobs, modify their contents, and manage leases. The Storage Blob Data Contributor role provides the data plane permissions necessary to perform these operations while adhering to the principle of least privilege by scoping it to the specific container.

Step-by-Step Solution

1
Identify the operation being performed by the application client.
The application uses EventProcessorClient which manages partition ownership leases and writes checkpoints in Azure Blob Storage.
Understanding the tasks performed by the client helps determine the required permissions.
2
Determine the required storage operations for these tasks.
The client must be able to read, write, create, and modify metadata (including leasing) on blobs in the checkpoint container.
Checkpointing and partition ownership require active write and lease operations, not just read access.
3
Map the required operations to the least privilege Azure Role-Based Access Control (RBAC) role.
The Storage Blob Data Contributor role provides read, write, and delete access to blob data, which covers all the client's requirements.
Adhering to the principle of least privilege ensures security boundaries are maintained while providing functional access.

Key Concept

To enable EventProcessorClient checkpointing and partition lease management using a managed identity, the identity must be granted the Storage Blob Data Contributor role at the storage container scope.
Rate this question

Topics

Implement Azure Event Hubs Solutions