Examkin

Question

Difficulty: HardSecure App Configuration and Key Vault References

An organization deploys a Node.js REST API inside Azure Container Apps (ACA). The container app uses a user-assigned managed identity named `id-api-prod` to authenticate.

The API loads its configuration from an Azure App Configuration instance named `config-payment-prod`. The App Configuration store contains a key named `PaymentGateway:ApiKey` which is configured as a Key Vault reference pointing to a secret named `gateway-api-key` in a Key Vault named `kv-payment-prod`.

The managed identity `id-api-prod` is assigned the App Configuration Data Reader role on the App Configuration store. However, at runtime, the API fails to start because it cannot retrieve the resolved value of the `PaymentGateway:ApiKey` setting, instead receiving an access denied authorization error.

Which of the following actions should you perform to resolve the error?

  1. Assign the Key Vault Secrets User role to the user-assigned managed identity `id-api-prod` on the Key Vault `kv-payment-prod`.Answer
  2. B
    Assign the Key Vault Secrets User role to the system-assigned managed identity of the Azure App Configuration store `config-payment-prod` on the Key Vault `kv-payment-prod`.
  3. C
    Modify the key value in Azure App Configuration to use the App Service reference syntax: `@Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/gateway-api-key/)`.
  4. D
    Assign the Key Vault Secrets Officer role to the user-assigned managed identity `id-api-prod` on the Azure App Configuration store `config-payment-prod`.

Answer

Assign the Key Vault Secrets User role to the user-assigned managed identity `id-api-prod` on the Key Vault `kv-payment-prod`.
The correct answer is to assign the Key Vault Secrets User role to the user-assigned managed identity `id-api-prod` on the Key Vault `kv-payment-prod`. This is because Key Vault references stored in Azure App Configuration are resolved at runtime by the client SDK running within the application. The application uses its own credentials (in this case, the user-assigned managed identity) to connect directly to the Key Vault and retrieve the secret values. Therefore, the application's identity must have authorization (such as the Key Vault Secrets User role) to read secrets from the Key Vault.

Step-by-Step Solution

1
Analyze how Azure App Configuration Key Vault references are resolved.
Identify that the client application (Node.js API inside Azure Container Apps) is responsible for fetching the secret from Azure Key Vault using its own credential at runtime.
Azure App Configuration does not fetch the secret value itself; it only returns a JSON metadata reference that tells the client SDK where the secret is stored.
2
Identify the authentication credential used by the client application.
The application uses the user-assigned managed identity `id-api-prod` for authentication.
This identity is configured on the Container App and holds the necessary roles to read configuration.
3
Determine the minimum required permission on the Key Vault to resolve the reference.
The identity `id-api-prod` needs read access to Key Vault secrets. This is granted by assigning the Key Vault Secrets User role on the Key Vault.
Granting Key Vault Secrets User role on the Key Vault allows the application to call the GET secret API, resolving the access denied error.

Key Concept

Key Vault references in Azure App Configuration are resolved at runtime by the client application using its own identity and credentials, requiring the client identity to have read permissions (like Key Vault Secrets User) on the Key Vault.
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic