Examkin

Question

Difficulty: MediumSecure App Configuration and Key Vault References

You are deploying a C# background service as an Azure Function App named func-processor-prod. The application must securely retrieve a connection string from an Azure Key Vault named kv-prod using a user-assigned managed identity named id-processor-prod. The resource ID of the user-assigned identity is /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-prod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-processor-prod.

You have already assigned the managed identity to the Function App and granted it the Key Vault Secrets User role on the Key Vault. You need to configure the Function App's application settings to resolve the database secret.

Which configuration steps and reference syntax must you use?

  1. Set the Function App's keyVaultReferenceIdentity property to the resource ID of id-processor-prod, and configure the application setting value as @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString/)Answer
  2. B
    Set the Function App's keyVaultReferenceIdentity property to the resource ID of id-processor-prod, and configure the application setting value as @Microsoft.KeyVault(VaultName=kv-prod;SecretName=DbConnectionString;Identity=id-processor-prod)
  3. C
    Configure the application setting value as @Azure.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString/)
  4. D
    Configure the application setting value as @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbConnectionString/) without setting the keyVaultReferenceIdentity property, as the platform automatically detects and uses the assigned user-assigned identity.

Answer

Set the Function App's keyVaultReferenceIdentity property to the resource ID of the user-assigned identity, and configure the application setting value using the correct @Microsoft.KeyVault syntax with the SecretUri parameter.
The correct option properly configures the keyVaultReferenceIdentity property on the Function App to point to the resource ID of the user-assigned managed identity. It also utilizes the correct @Microsoft.KeyVault syntax referencing the SecretUri of the secret in the Key Vault, which allows the App Service/Functions runtime to retrieve the connection string value at runtime.

Step-by-Step Solution

1
Assign the user-assigned identity to the Function App and grant it Secrets User permissions in Key Vault.
The identity is authorized to access the Key Vault secrets.
Before the platform can resolve secrets, the identity must have explicit read permissions on the Key Vault.
2
Configure the keyVaultReferenceIdentity property of the Function App resource to use the resource ID of the user-assigned managed identity.
The Function App is configured to use the specified user-assigned identity to fetch references.
If an app has multiple user-assigned identities or a combination of system-assigned and user-assigned identities, the platform needs this property set to know which identity to use for reference resolution.
3
Create the app setting in the Function App using the @Microsoft.KeyVault syntax.
The configuration setting is saved and the platform resolves it to the actual secret value at runtime.
Using the @Microsoft.KeyVault(SecretUri=...) format tells the Azure App Service/Functions runtime to intercept the configuration load and inject the secret.

Key Concept

Key Vault References using User-Assigned Managed Identity
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic