Examkin

Question

Difficulty: MediumDeploy and Configure Azure Container Apps

You are configuring a Bicep template to deploy an Azure Container App named `order-processor`. The application needs to connect to a database using a connection string that is stored as a secret in Azure Key Vault. The connection string must be exposed to the container as an environment variable named `DB_CONNECTION`. Which of the following configuration steps must you perform in the Bicep template to meet these requirements? (Select TWO.)

  1. Define a secret in the `configuration.secrets` block of the Container App, specifying the secret's name, Key Vault secret URL, and the managed identity resource ID.Answer
  2. In the container's `env` array, add an environment variable named `DB_CONNECTION` that references the defined secret using the `secretRef` property.Answer
  3. C
    In the container's `env` array, set the environment variable's `value` property directly to `@Microsoft.KeyVault(SecretUri=https://mykeyvault.vault.azure.net/secrets/dbconnection)`.
  4. D
    Configure the secret in the `configuration.secrets` block using a system-assigned managed identity, while granting the Key Vault permissions to a user-assigned managed identity.

Answer

To configure the Container App to use a Key Vault secret as an environment variable, you must define the secret in the `configuration.secrets` block of the Container App resource pointing to the Key Vault secret URL with a managed identity, and reference that secret name via the `secretRef` property in the container's environment variables array.
To successfully pull a secret from Key Vault and inject it into a Container App container as an environment variable, two configuration steps are required. First, the secret must be declared in the Container App's configuration section, linking the secret name to the Key Vault URL and specifying which identity has the permission to read it. Second, the container's environment variable array must reference the secret's name using the `secretRef` property.

Step-by-Step Solution

1
Expose the Key Vault secret to the Container App configuration.
A secret is declared in `configuration.secrets` referencing the Key Vault URL and a managed identity that has permissions to read it.
Azure Container Apps requires Key Vault secrets to be declared at the resource level before they can be referenced by individual containers.
2
Map the declared secret to the container's environment variables.
The container configuration includes an environment variable with a `secretRef` pointing to the declared secret.
This injects the secret value into the container's runtime environment under the specified variable name without exposing the plaintext value in the template.

Key Concept

Configuring secrets and environment variables in Azure Container Apps using Key Vault references.
Estimated Time:1m 30s
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic