Examkin

Question

Difficulty: MediumConfigure Azure App Service Web Apps

You deploy an Azure App Service web app named app-sales-prod and enable a system-assigned managed identity. You store a database password in an Azure Key Vault named kv-sales-prod.

To reference the secret in the web app, you create an application setting named DbPassword and configure its value as follows:

@Microsoft.KeyVault(SecretUri=https://kv-sales-prod.vault.azure.net/secrets/db-password/)

When testing the application, you notice the secret is not resolved, and the Key Vault reference status displays as 'Access to Key Vault was forbidden'.

Which of the following actions should you perform to resolve this error?

  1. Assign the 'Key Vault Secrets User' Azure role to the web app's system-assigned managed identity at the key vault scope.Answer
  2. B
    Update the reference syntax in the application setting by adding the 'UserAssignedIdentity' parameter set to the system-assigned managed identity's resource ID.
  3. C
    Change the application setting value to the secret URI without the '@Microsoft.KeyVault' prefix.
  4. D
    Assign the 'Key Vault Contributor' Azure role to the web app's system-assigned managed identity at the key vault scope.

Answer

Assign the 'Key Vault Secrets User' Azure role to the web app's system-assigned managed identity at the key vault scope.
To resolve the 'Access to Key Vault was forbidden' error, the managed identity must be granted data plane access to read the secrets. Assigning the 'Key Vault Secrets User' Azure RBAC role at the key vault scope provides the identity with the required permissions to retrieve the secret value.

Step-by-Step Solution

1
Analyze the error status 'Access to Key Vault was forbidden'.
Determine that the App Service managed identity is successfully attempting to reach the Key Vault but lacks authorization to read the secret.
The error specifically indicates authorization failure (HTTP 403 Forbidden) rather than a syntax or connectivity issue.
2
Evaluate the difference between control plane and data plane permissions.
Identify that reading secret values is a data plane operation requiring roles such as 'Key Vault Secrets User' or specific Key Vault Access Policies.
Administrative roles like 'Key Vault Contributor' do not grant access to data plane secrets by default.
3
Identify the correct configuration for a system-assigned managed identity.
Confirm that system-assigned identities do not require the 'UserAssignedIdentity' parameter in the reference syntax.
The reference syntax for system-assigned identities automatically uses the default identity assigned to the App Service.

Key Concept

Key Vault References in App Service and authorization using Managed Identities
Estimated Time:1m 30s
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic