Examkin

Question

Difficulty: Very hardImplement Azure Event Hubs Solutions

You are developing a .NET background worker service that consumes high-throughput sensor telemetry from an Azure Event Hub using the EventProcessorClient class from the Azure.Messaging.EventHubs.Processor library. The service is containerized and deployed to Azure Container Apps with multiple replica instances sharing the same consumer group.

To coordinate partition ownership and perform checkpointing, you configure the EventProcessorClient to use a container in an Azure Blob Storage account. You configure the Azure Container App to use a User-Assigned Managed Identity.

During deployment, the service instances start up but fail to claim partition ownership. The container logs output multiple RequestFailedException errors with an HTTP status of 403 (Authorization Failed) when attempting to perform write operations on the checkpoint blobs. You verify that the User-Assigned Managed Identity has been assigned the Storage Blob Data Contributor role on the storage account scope.

Which of the following describes the cause of this lease coordination failure and the correct resolution?

  1. A
    The EventProcessorClient is restricted by the Azure SDK design to only utilize system-assigned managed identities for lease management. To resolve this, you must enable the system-assigned managed identity on the Container App, assign it the Owner role on the storage account, and disable the user-assigned managed identity.
  2. B
    The EventProcessorClient is attempting to modify active leases that are locked. To resolve this, you must run a background task that uses BlobClient.DeleteAsync() without specifying a lease ID to force-delete the active lease blobs in the checkpoints container before the processor starts.
  3. The DefaultAzureCredential was instantiated without configuration, causing it to fall back to the system-assigned managed identity (or another default credential) which does not have permissions on the storage container. To resolve this, specify the client ID of the user-assigned managed identity in the DefaultAzureCredentialOptions when initializing the credential.Answer
  4. D
    The checkpoint metadata payload exceeds the 64 KB storage limit allowed for lease blobs in Azure Blob Storage. To resolve this, you must store the telemetry event payloads in Azure Queue Storage instead of Azure Event Hubs to keep the partition state below the size limit.

Answer

The DefaultAzureCredential was instantiated without configuration, causing it to fall back to the system-assigned managed identity (or another default credential) which does not have permissions on the storage container. To resolve this, specify the client ID of the user-assigned managed identity in the DefaultAzureCredentialOptions when initializing the credential.
When using user-assigned managed identities in environments with multiple identities or where the client ID must be explicitly declared, DefaultAzureCredential will not automatically select the user-assigned identity. Without specifying the client ID, the credential will attempt to use the system-assigned managed identity or fall back to other credentials, resulting in a 403 Forbidden error because that identity lacks the Storage Blob Data Contributor role. Providing the client ID via DefaultAzureCredentialOptions ensures the correct identity is selected and authenticated.

Step-by-Step Solution

1
Identify the resource throwing the HTTP 403 authorization error.
The EventProcessorClient throws RequestFailedException (403) when writing to Blob Storage.
Blob Storage requires appropriate write permissions (Storage Blob Data Contributor) to store checkpoints and claim partition leases.
2
Analyze the credential mechanism used for BlobContainerClient.
DefaultAzureCredential is used without specifying a client ID.
In environments with user-assigned managed identities, DefaultAzureCredential requires the specific client ID to locate and use that identity; otherwise, it defaults to the system-assigned identity.
3
Verify the role assignments for the identity.
The user-assigned identity has Storage Blob Data Contributor, but the system-assigned identity does not exist or lacks permissions.
Specifying the client ID in DefaultAzureCredentialOptions aligns the active credential with the authorized identity, restoring lease coordination functionality.

Key Concept

Configuring identity-based authentication and lease coordination in EventProcessorClient
Rate this question

Topics

Implement Azure Event Hubs Solutions