Examkin

Question

Difficulty: MediumSecure App Configuration and Key Vault References

You are configuring a secure ASP.NET Core web application hosted in an Azure App Service to load configuration settings from an Azure App Configuration store. The configuration store contains key-values that reference secrets stored in an Azure Key Vault. You want to use a system-assigned managed identity to authenticate and authorize all access between these resources without storing credentials. In which order should you perform the steps to configure the security and connection between these services?

  1. 1Enable a system-assigned managed identity on the Azure App Service.
  2. 2Assign the 'App Configuration Data Reader' role to the App Service's managed identity on the Azure App Configuration store.
  3. 3Assign the 'Key Vault Secrets User' role to the App Service's managed identity on the Azure Key Vault.
  4. 4Configure the App Service application settings to specify the App Configuration endpoint, and update the application startup code to use DefaultAzureCredential.

Answer

To configure the security and connection, you must first enable a system-assigned managed identity on the Azure App Service. Next, assign the 'App Configuration Data Reader' role to the App Service's managed identity on the App Configuration store. Then, assign the 'Key Vault Secrets User' role to the App Service's managed identity on the Key Vault. Finally, configure the App Service application settings to specify the App Configuration endpoint, and update the application startup code to initialize the configuration provider using DefaultAzureCredential.
The correct order requires establishing the system-assigned managed identity first. Once the identity exists, permissions must be assigned to it on both the Azure App Configuration store (App Configuration Data Reader) and the Azure Key Vault (Key Vault Secrets User). Finally, the App Service configuration must be updated with the endpoint, and the code updated to load configuration via DefaultAzureCredential.

Step-by-Step Solution

1
Enable system-assigned managed identity on the App Service.
A service principal is registered in Microsoft Entra ID for the App Service instance.
You must establish the identity principal in the tenant before assigning role-based access control permissions to it.
2
Grant 'App Configuration Data Reader' to the App Service identity on the App Configuration store.
The App Service is authorized to read keys and values from the configuration store.
This permission is necessary for the App Configuration provider to read settings and identify Key Vault references.
3
Grant 'Key Vault Secrets User' to the App Service identity on the Key Vault.
The App Service is authorized to read secret values directly from the Key Vault.
Key Vault references in App Configuration are resolved on the client side by the application itself; therefore, the App Service identity needs direct read access to Key Vault.
4
Add the endpoint configuration and modify startup code to use DefaultAzureCredential.
The application successfully connects to the App Configuration store at startup and resolves secrets using its managed identity.
This connects all configured security settings to the running application code.

Key Concept

Secure App Configuration and Key Vault References using Managed Identity
Estimated Time:2m 0s
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic