Examkin

Question

Difficulty: Very hardRun Containerized Solutions using Azure Container Instances

An organization is designing an Azure Resource Manager (ARM) template to deploy a multi-container group to Azure Container Instances (ACI). The deployment must satisfy the following requirements:
- The container group must pull a custom web application image from a private Azure Container Registry (ACR) named `myregistry.azurecr.io`.
- Both containers in the group must retrieve database connection strings from Azure Key Vault at startup without using hardcoded credentials.
- The deployment must utilize managed identities to authenticate against both the ACR and the Key Vault, adhering to the principle of least privilege.

Which configuration strategy should you implement in the template and Azure roles?

  1. Configure the container group with a user-assigned managed identity. Assign the AcrPull role to this identity on the ACR, and the Key Vault Secrets User role on the Key Vault. In the template, reference this user-assigned managed identity's resource ID in both the identity block and the identity property of the imageRegistryCredentials block.Answer
  2. B
    Configure the container group with a system-assigned managed identity. Assign the AcrPull role to this identity on the ACR, and the Key Vault Secrets User role on the Key Vault. In the template, enable the system-assigned identity in the identity block, and reference it in the identity property of the imageRegistryCredentials block.
  3. C
    Configure the container group with a user-assigned managed identity. Assign the AcrPull role to this identity on the ACR, and reference its resource ID in the identity block and the imageRegistryCredentials block. In the application code, request a token for the user-assigned identity to authenticate to Key Vault, without assigning any RBAC roles or access policies to the identity in Key Vault.
  4. D
    Configure the container group with a user-assigned managed identity. Assign the AcrPull role to this identity on the ACR, and the Key Vault Secrets User role on the Key Vault. Reference the identity's resource ID in the identity block, but omit the imageRegistryCredentials block to allow the container group to authenticate implicitly during the image pull.

Answer

The correct strategy is to configure the container group with a user-assigned managed identity, assign the required roles on the Azure Container Registry (ACR) and Azure Key Vault, and reference the identity's resource ID in both the identity block and the imageRegistryCredentials block.
To pull an image from a private ACR using a managed identity during ACI deployment, a user-assigned managed identity must be used. A system-assigned managed identity is not created until after the container group is deployed, so it cannot be used to authenticate the initial image pull. The user-assigned identity must be assigned the AcrPull role on the ACR and the Key Vault Secrets User role (or equivalent access policy) on the Key Vault. Furthermore, the template must explicitly list the identity in the identity block and refer to its resource ID in the imageRegistryCredentials block.

Step-by-Step Solution

1
Determine the resource lifecycle requirement for pulling images from a private Azure Container Registry during provisioning.
Identify that ACI requires an identity to exist prior to container group deployment to authenticate the image pull. A system-assigned managed identity cannot be used because it is created only after the deployment completes.
This rules out any option relying on system-assigned managed identity for the image pull credentials.
2
Identify the authentication mechanism required for the private registry pull.
Determine that the template must explicitly contain an 'imageRegistryCredentials' block referencing the user-assigned identity's resource ID.
Implicit authentication is not supported by ACI for private ACR repositories, even if the ACI container group is assigned the user-assigned identity.
3
Determine the authorization requirements for the container group to access Key Vault secrets.
The identity assigned to the container group must be explicitly granted the 'Key Vault Secrets User' RBAC role or have an access policy configured in the Key Vault.
Without explicit permissions in Key Vault, the application code running inside ACI will receive an Access Denied error when requesting database connection strings at startup.

Key Concept

Using a user-assigned managed identity to authenticate both private ACR image pulls and Azure Key Vault secret access in Azure Container Instances.
Estimated Time:3m 0s
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic