You are configuring an Azure Event Grid system topic to route system events to an Azure Function. To prevent event loss, you must configure dead-lettering to a secured Azure Storage account. The storage account has its firewall enabled, restricting access to virtual networks and trusted Microsoft services. Which configuration must you implement to authorize Event Grid to write the dead-letter events?
- AGenerate a Shared Access Signature (SAS) token at the container level with write permission, and append this SAS token to the dead-letter destination container URL in the event subscription.
- BConfigure an Azure Key Vault access policy that grants the Event Grid service principal GET permission to retrieve the storage account access keys.
- Enable a system-assigned managed identity on the Event Grid topic, assign the identity the Storage Blob Data Contributor role on the storage account, and configure the event subscription to use this identity for dead-letter delivery.Answer
- DConfigure a user-assigned managed identity on the storage account, and assign it the Event Grid EventSubscription Writer role on the Event Grid topic.
Answer
Enable a system-assigned managed identity on the Event Grid topic, assign the identity the Storage Blob Data Contributor role on the storage account, and configure the event subscription to use this identity for dead-letter delivery.
To write dead-letter events to an Azure Storage account protected by a firewall, Event Grid must be recognized as a trusted Microsoft service. This requires enabling a system-assigned (or user-assigned) managed identity on the Event Grid topic, granting that identity the Storage Blob Data Contributor role on the destination storage account, and configuring the event subscription to use the managed identity when delivering dead-letter events.
Step-by-Step Solution
Key Concept
Configuring Event Grid dead-lettering with managed identities to write to secured storage accounts.