Examkin

Question

Difficulty: HardAzure Key Vault Secret, Key, and Certificate Management

You are deploying a C# ASP.NET Core web application to Azure App Service. The application is configured to use a system-assigned managed identity. The application must retrieve a database password from an Azure Key Vault named kv-finance-prod. The Key Vault is configured with the Vault access policy permission model.

The application contains the following C# code to retrieve the secret:

csharp
using System;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

// ...
var client = new SecretClient(new Uri("https://kv-finance-prod.vault.azure.net/"), new DefaultAzureCredential());
KeyVaultSecret secret = await client.GetSecretAsync("DbPassword");

During testing, the call to GetSecretAsync fails with a RequestFailedException showing a 403 (Forbidden) error.

Which action should you perform to resolve the authorization issue using the minimum level of privileges?

  1. A
    Assign the Key Vault Secrets User Azure RBAC role to the application's system-assigned managed identity at the Key Vault scope.
  2. B
    Add a Key Vault access policy for the application's system-assigned managed identity and grant it the Get and List secret permissions.
  3. Add a Key Vault access policy for the application's system-assigned managed identity and grant it the Get secret permission.Answer
  4. D
    Configure a user-assigned managed identity for the App Service and assign it the Reader Azure RBAC role at the resource group scope.

Answer

Add a Key Vault access policy for the application's system-assigned managed identity and grant it the Get secret permission.
The Azure Key Vault uses the Vault access policy permission model. Under this model, data plane authorization must be configured via Key Vault access policies rather than Azure RBAC. Since the application retrieves a specific secret using GetSecretAsync, granting only the 'Get' secret permission in the access policy satisfies the minimum privilege requirements.

Step-by-Step Solution

1
Identify the active authorization model of the Azure Key Vault.
The Key Vault is configured to use the Vault access policy model rather than Azure role-based access control (Azure RBAC).
This determines whether to configure access policies or assign RBAC roles to authorize the application's identity.
2
Analyze the C# SDK code to determine the required permission.
The application calls GetSecretAsync to retrieve a single secret by its exact name.
This operation requires only the 'Get' secret permission. The 'List' permission is not required to read a specific secret.
3
Apply the permission under the legacy Vault access policy model.
Create a new Key Vault access policy targeting the application's system-assigned managed identity, selecting only the 'Get' permission for secrets.
This grants the minimum level of privileges required to resolve the 403 Forbidden error without introducing unnecessary access rights like List.

Key Concept

Key Vault Data Plane Access Policies
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic