Examkin

Question

Difficulty: Very hardConfigure Azure App Service Web Apps

You are configuring an Azure App Service web app named webapp-prod that runs on a Linux App Service Plan. The web app must retrieve a database connection string from an Azure Key Vault named vault-prod.

To adhere to security best practices, you create a User-Assigned Managed Identity named identity-prod, grant it Secret Get permissions on vault-prod, and assign identity-prod to webapp-prod. You decide not to enable the System-Assigned Managed Identity.

You need to configure the web app's settings so that it can resolve the connection string from the latest version of the secret named db-conn in vault-prod.

Which of the following configurations must you apply?

  1. Set the web app's keyVaultReferenceIdentity site configuration property to the resource ID of identity-prod, and configure an application setting named DbConnectionString with the value @Microsoft.KeyVault(VaultName=vault-prod;SecretName=db-conn).Answer
  2. B
    Configure an application setting named keyVaultReferenceIdentity with the value set to the client ID of identity-prod, and configure an application setting named DbConnectionString with the value @Microsoft.KeyVault(VaultName=vault-prod;SecretName=db-conn).
  3. C
    Set the web app's keyVaultReferenceIdentity site configuration property to the resource ID of identity-prod, and configure an application setting named DbConnectionString with the value {"uri":"https://vault-prod.vault.azure.net/secrets/db-conn"}.
  4. D
    Configure the Key Vault access policy to grant the web app's system identity permission to get secrets, and configure an application setting named DbConnectionString with the value @KeyVault(SecretUri=https://vault-prod.vault.azure.net/secrets/db-conn).

Answer

Set the web app's keyVaultReferenceIdentity site configuration property to the resource ID of identity-prod, and configure an application setting named DbConnectionString with the value @Microsoft.KeyVault(VaultName=vault-prod;SecretName=db-conn).
The correct configuration is to set the web app's keyVaultReferenceIdentity site configuration property to the resource ID of the user-assigned identity, and use the @Microsoft.KeyVault(VaultName=vault-prod;SecretName=db-conn) syntax for the application setting. This ensures App Service is explicitly told which user-assigned identity to use for token acquisition and provides the proper syntax for resolving the latest secret version.

Step-by-Step Solution

1
Assign the user-assigned identity to the web app.
The identity-prod identity is associated with webapp-prod, but App Service does not yet know which identity to use for Key Vault references.
By default, App Service attempts to use the system-assigned identity to fetch Key Vault references unless a specific user-assigned identity is defined.
2
Configure the keyVaultReferenceIdentity site configuration property.
The keyVaultReferenceIdentity property is set to the Azure Resource Manager (ARM) resource ID of identity-prod.
This configuration informs App Service which user-assigned identity should be used to authenticate against the Key Vault when resolving app setting references.
3
Set the application setting using the correct reference syntax.
An application setting named DbConnectionString is created with the value @Microsoft.KeyVault(VaultName=vault-prod;SecretName=db-conn).
This syntax references the key vault by name and specifies the secret. Omitting the version parameter ensures that App Service always retrieves the latest version of the secret.

Key Concept

Key Vault references in Azure App Service with User-Assigned Managed Identities require specifying the keyVaultReferenceIdentity site configuration property using the identity's resource ID, along with the proper @Microsoft.KeyVault reference syntax.
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic