Examkin

Question

Difficulty: MediumRun Containerized Solutions using Azure Container Instances

You are building a scheduled batch processing application that runs as an Azure Container Instances (ACI) container group. The container image is hosted in a private Azure Container Registry (ACR). The batch application processes sensitive medical records and must retrieve an encryption key stored in Azure Key Vault at startup. You need to configure the ACI container group so that it can pull the image from the private ACR and authenticate to the Key Vault to retrieve the encryption key using the minimum level of privileges. Which configuration should you implement?

  1. A
    Assign a system-assigned managed identity to the container group, assign the AcrPull role to this identity for the ACR resource, and grant the identity GET permissions in the Key Vault access policies.
  2. Assign a user-assigned managed identity to the container group, assign the AcrPull role to this identity for the ACR resource, and grant the identity GET permissions in the Key Vault access policies.Answer
  3. C
    Assign a user-assigned managed identity to the container group, assign the AcrPull role to this identity for the ACR resource, and enable Key Vault firewall bypass for trusted Microsoft services without defining access policies.
  4. D
    Assign a user-assigned managed identity to the container group, grant the identity GET permissions in the Key Vault access policies, and configure the container startup command to run 'az acr login' to authenticate the registry pull.

Answer

Assign a user-assigned managed identity to the container group, assign the AcrPull role to this identity for the ACR resource, and grant the identity GET permissions in the Key Vault access policies.
The correct configuration uses a user-assigned managed identity. Because ACI needs to pull the container image from a private registry before the container group itself is fully created, a system-assigned identity cannot be used for registry authentication. Assigning the AcrPull role to the user-assigned identity allows ACI to pull the image, and granting GET permissions to the same identity in the Key Vault access policies ensures the application can retrieve secrets at runtime.

Step-by-Step Solution

1
Identify the authentication needs of the ACI resource at deployment time versus runtime.
The ACI host needs to authenticate to the private registry before the container runs, whereas the application inside the container needs to access Key Vault during runtime.
This determines whether a system-assigned or user-assigned identity is required, as system-assigned identities do not exist until after deployment.
2
Select the correct identity type and configure registry access.
A user-assigned managed identity is selected and granted the AcrPull role on the Azure Container Registry.
This allows the ACI service host to authenticate using the user-assigned identity to pull the image during deployment.
3
Configure access to Key Vault.
The same user-assigned managed identity is granted GET permission on the Key Vault secrets.
This permits the application running inside the container to authenticate to the Key Vault and retrieve the required encryption key.

Key Concept

Authentication and authorization configuration for Azure Container Instances pulling from private Azure Container Registry and accessing Azure Key Vault using managed identities.
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic