Examkin

Question

Difficulty: HardConfigure Azure App Service Web Apps

A developer is configuring a web app named prod-orders-app in Azure App Service. The app must retrieve a database password from an Azure Key Vault named orders-vault using a Key Vault reference in the application settings. You have created a user-assigned managed identity named orders-identity and granted it the 'Key Vault Secrets User' role on the Key Vault. You have also associated orders-identity with the web app. Which configuration should you apply to the web app to ensure it successfully retrieves the secret using the user-assigned managed identity?

  1. A
    Set the DatabasePassword app setting to @KeyVault(SecretUri=https://orders-vault.vault.azure.net/secrets/db-password/) and configure the web app's key vault reference identity by running az webapp update --name prod-orders-app --resource-group myRG --keyvault-reference-identity <resource-id-of-orders-identity>.
  2. B
    Set the DatabasePassword app setting to @Microsoft.KeyVault(SecretUri=https://orders-vault.vault.azure.net/secrets/db-password/) and enable the system-assigned managed identity on the web app, leaving the keyvault-reference-identity configuration parameter unset.
  3. Set the DatabasePassword app setting to @Microsoft.KeyVault(SecretUri=https://orders-vault.vault.azure.net/secrets/db-password/) and configure the web app's key vault reference identity by running az webapp update --name prod-orders-app --resource-group myRG --keyvault-reference-identity <resource-id-of-orders-identity>.Answer
  4. D
    Set the DatabasePassword app setting to @Microsoft.KeyVault(SecretUri=https://orders-vault.vault.azure.net/secrets/db-password/) and configure the web app's key vault reference identity by running az webapp update --name prod-orders-app --resource-group myRG --keyvault-reference-identity <resource-id-of-orders-identity>, but grant the 'Key Vault Secrets User' role to the App Service's deployment slot principal instead of the managed identity.

Answer

Set the DatabasePassword app setting to @Microsoft.KeyVault(SecretUri=https://orders-vault.vault.azure.net/secrets/db-password/) and configure the web app's key vault reference identity by running az webapp update --name prod-orders-app --resource-group myRG --keyvault-reference-identity <resource-id-of-orders-identity>.
To successfully resolve a Key Vault reference using a user-assigned managed identity, you must use the correct fully qualified prefix '@Microsoft.KeyVault' and explicitly configure the App Service's 'keyVaultReferenceIdentity' property to the Resource ID of the user-assigned identity. This instructs App Service to use the specific user-assigned identity to perform the runtime call to Key Vault.

Step-by-Step Solution

1
Formulate the correct Key Vault reference syntax for the application setting.
Use the format @Microsoft.KeyVault(SecretUri=https://orders-vault.vault.azure.net/secrets/db-password/).
App Service requires the fully qualified @Microsoft.KeyVault prefix along with the SecretUri parameter to correctly identify and parse the Key Vault reference.
2
Configure the web app to use the user-assigned managed identity for resolving Key Vault references.
Run the command: az webapp update --name prod-orders-app --resource-group myRG --keyvault-reference-identity <resource-id-of-orders-identity>.
By default, App Service attempts to resolve Key Vault references using the system-assigned managed identity. To use a user-assigned identity, you must set the keyVaultReferenceIdentity configuration property to the Resource ID of that identity.
3
Ensure the user-assigned managed identity has access to retrieve secrets from the Key Vault.
Verify that the 'Key Vault Secrets User' role is assigned to the user-assigned managed identity on the Key Vault.
At runtime, App Service uses the configured user-assigned managed identity to authenticate. The identity must have explicit read access to Key Vault secrets.

Key Concept

Key Vault references in App Service can be configured to use a user-assigned managed identity by setting the keyVaultReferenceIdentity configuration property to the Resource ID of the identity and using the correct @Microsoft.KeyVault prefix in the application setting.
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic