An organization has deployed a web app named app-finance to Azure App Service. The application needs to retrieve a database connection string from an Azure Key Vault named kv-prod. The web app is configured to use a system-assigned managed identity, and Key Vault access policies have been configured to allow this identity to read secrets. You need to add an application setting named DbConnectionString to the web app that references the secret DbPassword in the Key Vault. Which value should you set for the DbConnectionString app setting?
- @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbPassword)Answer
- B@Microsoft.KeyVault(VaultName=kv-prod,SecretName=DbPassword)
- C@Microsoft.Azure.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbPassword)
- Dhttps://kv-prod.vault.azure.net/secrets/DbPassword
Answer
The app setting should be configured with the value @Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbPassword) to resolve the secret from the Key Vault.
The correct format for a Key Vault reference in Azure App Service is `@Microsoft.KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/<secret-name>)` or `@Microsoft.KeyVault(VaultName=<vault-name>;SecretName=<secret-name>)`. The option using the `@Microsoft.KeyVault` prefix with the correct `SecretUri` value successfully retrieves the secret.
Step-by-Step Solution
Key Concept
Key Vault references in Azure App Service allow an application to access secrets from Key Vault as environment variables without code changes.
Estimated Time:1m 30s