Examkin

Question

Difficulty: HardAzure Key Vault Secret, Key, and Certificate Management

You are deploying a web application to multiple Azure App Services in different regions. The applications need to retrieve a database connection string stored in an Azure Key Vault named `kv-checkout-prod`.

The Azure Key Vault is configured to use the Azure role-based access control (Azure RBAC) permission model for authorization. To simplify permission management across all regions and avoid recreating role assignments when App Services are redeployed, you decide to use a single user-assigned managed identity named `id-checkout-prod`.

You need to configure the App Services to retrieve the secret value using this identity while adhering to the principle of least privilege.

Which configuration should you apply?

  1. A
    Assign the Key Vault Secrets User role to the system-assigned managed identity of each App Service on the Key Vault, and configure the application setting to `@Microsoft.KeyVault(SecretUri=https://kv-checkout-prod.vault.azure.net/secrets/DbConnectionString/)`.
  2. B
    Assign the Key Vault Secrets User role to the `id-checkout-prod` identity on the Key Vault, associate the identity with each App Service, and configure the application setting to `@Microsoft.KeyVault(SecretUri=https://kv-checkout-prod.vault.azure.net/secrets/DbConnectionString/;Identity=id-checkout-prod)`.
  3. Assign the Key Vault Secrets User role to the `id-checkout-prod` identity on the Key Vault, associate the identity with each App Service, set the `keyVaultReferenceIdentity` property of each App Service to the resource ID of the identity, and configure the application setting to `@Microsoft.KeyVault(SecretUri=https://kv-checkout-prod.vault.azure.net/secrets/DbConnectionString/)`.Answer
  4. D
    Create a Key Vault access policy on `kv-checkout-prod` that grants the Secret Get permission to the `id-checkout-prod` identity, associate the identity with each App Service, set the `keyVaultReferenceIdentity` property of each App Service to the resource ID of the identity, and configure the application setting to `@Microsoft.KeyVault(SecretUri=https://kv-checkout-prod.vault.azure.net/secrets/DbConnectionString/)`.

Answer

To resolve the secret value using a user-assigned identity, you must assign the Key Vault Secrets User role to the user-assigned identity, link it to the App Services, configure each App Service to use that identity for Key Vault references via the keyVaultReferenceIdentity property, and use the correct @Microsoft.KeyVault(SecretUri=...) reference syntax.
Assigning the Key Vault Secrets User role to the user-assigned identity, linking it to the App Services, setting the keyVaultReferenceIdentity property to the identity's resource ID, and using the correct @Microsoft.KeyVault(SecretUri=...) syntax is the correct configuration. This ensures that the App Service uses the user-assigned identity to resolve the Key Vault reference, that the identity has the necessary RBAC permissions to read the secret, and that the reference syntax is valid.

Step-by-Step Solution

1
Identify the authentication and authorization requirements for the Key Vault.
Since the vault uses the Azure RBAC permission model, permissions must be managed using RBAC roles rather than access policies. The minimum privilege role for reading secrets is Key Vault Secrets User.
Access policies are ignored when Azure RBAC is enabled, and Key Vault Secrets User is the least-privileged role for retrieving secret values.
2
Determine how the user-assigned managed identity is configured for the App Service.
The user-assigned identity must be associated with the App Service, and the App Service's keyVaultReferenceIdentity property must be set to the identity's resource ID.
By default, App Service attempts to resolve Key Vault references using its system-assigned identity. To use a user-assigned identity instead, it must be explicitly configured as the keyVaultReferenceIdentity.
3
Verify the correct Key Vault reference syntax.
The correct format is @Microsoft.KeyVault(SecretUri=https://kv-checkout-prod.vault.azure.net/secrets/DbConnectionString/).
The reference syntax is strict and does not support inline identity parameters like Identity=id-checkout-prod.

Key Concept

Azure App Service Key Vault references with user-assigned managed identities and Azure RBAC authorization.
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic