Examkin

Question

Difficulty: MediumProvision and Configure Azure API Management

You are configuring a custom domain for the gateway endpoint of an Azure API Management (APIM) instance. The TLS certificate for the custom domain is stored in an Azure Key Vault. You want to use the system-assigned managed identity of the APIM instance to authorize access to the Key Vault. Which of the following describes the correct set of actions to configure the custom domain?

  1. A
    Enable the system-assigned managed identity on the API Management instance. In API Management, add the custom domain and reference the Key Vault certificate URL. The system-assigned identity is automatically granted access upon domain configuration.
  2. B
    Configure a new Azure Active Directory app registration. Generate a client secret and add it to the API Management Named Values. Grant the app registration Get secret permission in Key Vault, and configure the custom domain using the named value.
  3. Enable the system-assigned managed identity on the API Management instance. Grant the managed identity the Get secret permission in the Key Vault access policies. In API Management, add the custom domain and select the certificate from the Key Vault.Answer
  4. D
    Enable the system-assigned managed identity on the API Management instance. In API Management, add the custom domain and reference the Key Vault certificate using the @Microsoft.KeyVault syntax in the Hostname configuration.

Answer

Enable the system-assigned managed identity on the API Management instance, grant the managed identity the Get secret permission in the Key Vault access policies, and configure the custom domain in API Management by selecting the certificate from Key Vault.
To secure a custom domain in Azure API Management using a certificate from Azure Key Vault, you must first enable the system-assigned managed identity on the API Management instance. Next, you must grant this identity the Get secret permission in the Key Vault's access policies (or assign an equivalent RBAC role such as Key Vault Secrets User), as API Management needs to read the secret representing the certificate to access the private key. Finally, the custom domain can be configured within the API Management instance by referencing the Key Vault certificate.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the API Management instance.
The instance gets an identity registered in Microsoft Entra ID (Azure Active Directory).
This allows the API Management instance to authenticate directly against Azure resources like Key Vault without managing credentials.
2
Configure Azure Key Vault access policies to grant the API Management system-assigned managed identity the 'Get' permission for Secrets.
The managed identity is authorized to retrieve secrets from the Key Vault.
API Management requires the 'Get' permission for secrets (rather than just certificates) to retrieve the private key of the certificate stored in Key Vault.
3
In the API Management instance, go to Custom Domains, add a new gateway hostname, choose Key Vault as the certificate source, select the certificate, and save.
The custom domain is configured and bound to the TLS certificate retrieved from Key Vault.
This binds the custom domain to the gateway endpoint and enables TLS handshake using the certificate.

Key Concept

Key Vault integration for API Management custom domains using managed identity
Rate this question

Topics

Provision and Configure Azure API Management