Examkin

Question

Difficulty: MediumDeploy and Configure Azure Container Apps

You are deploying an Azure Container App named `payment-processor` that needs to securely access a database connection string stored in an Azure Key Vault named `kv-vault`.

You want the Container App to authenticate to the Key Vault using a system-assigned managed identity and expose the secret to the application container as an environment variable named `DB_CONNECTION`.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Enable a system-assigned managed identity on the `payment-processor` Container App.
  2. 2In the Azure Key Vault `kv-vault`, assign the Key Vault Secrets User role to the Container App's managed identity principal.
  3. 3Add a secret named `db-secret` to the Container App that references the Azure Key Vault secret URI.
  4. 4Update the container configuration of the Container App to map the environment variable `DB_CONNECTION` to the `db-secret` secret.

Answer

First, enable a system-assigned managed identity on the `payment-processor` Container App. Second, in the Azure Key Vault `kv-vault`, assign the Key Vault Secrets User role to the Container App's managed identity principal. Third, add a secret named `db-secret` to the Container App that references the Azure Key Vault secret URI. Fourth, update the container configuration of the Container App to map the environment variable `DB_CONNECTION` to the `db-secret` secret.
To secure secrets in an Azure Container App using Key Vault, the application must first have an identity. Enabling the system-assigned managed identity creates a principal in Microsoft Entra ID. Next, this identity must be granted the Key Vault Secrets User role so that the Container App is authorized to read the secret. Once authorized, the secret is mapped at the Container App resource level using the Key Vault secret URI. Finally, the container template within the Container App references this App-level secret to expose it as an environment variable to the application code.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Container App.
A service principal representing the Container App is created in Microsoft Entra ID.
An identity must exist before you can assign roles or permissions to it.
2
Assign the Key Vault Secrets User role to the system-assigned managed identity on the Key Vault.
The identity principal is granted permission to read secret values.
The Container App environment must be authorized to pull secret values from Key Vault at runtime.
3
Create a secret at the Container App level that references the Key Vault secret URI.
A secret reference is registered in the Container App environment.
Container Apps act as the secure store that bridges the Key Vault secret and the application container.
4
Map the Container App secret to the container's environment variable.
The container configuration is updated with the environment variable definition.
This injects the decrypted secret value into the container's environment space.

Key Concept

Configuring Key Vault Secret References in Azure Container Apps using Managed Identities

Alternative Method

You can also perform this configuration using a Bicep template by defining the identity block, setting up the Microsoft.Authorization/roleAssignments resource, defining the secrets array in the container app resource, and referencing the secret in the env block of the container definition.
Estimated Time:2m 0s
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic