Examkin

Question

Difficulty: MediumSecure App Configuration and Key Vault References

A developer is deploying a Go-based web application to Azure App Service. The application must retrieve a database connection string stored in an Azure Key Vault named `kv-prod-westus`. A system-assigned managed identity is enabled for the App Service.

You configure an application setting in the App Service with the key `DbConnectionString` and the value `@Microsoft.KeyVault(VaultName=kv-prod-westus;SecretName=DbConnectionString)`.

During testing, the application fails to retrieve the secret value and instead reads the raw reference string.

Which of the following is the most likely cause of this issue?

  1. A
    The App Service application setting key must match the secret name in the Key Vault exactly for the reference to resolve.
  2. The system-assigned managed identity of the App Service has not been granted the 'Get' secret permission in the Key Vault access policies or Azure RBAC roles.Answer
  3. C
    The Key Vault reference must be configured using a user-assigned managed identity, as system-assigned managed identities are not supported for Key Vault references.
  4. D
    The Key Vault reference value is using incorrect syntax because the secret version parameter is required when referencing secrets by name.

Answer

The system-assigned managed identity of the App Service has not been granted the 'Get' secret permission in the Key Vault access policies or Azure RBAC roles.
The correct answer is that the system-assigned managed identity lacks the necessary 'Get' secret permission. When Azure App Service is unable to resolve a Key Vault reference—due to missing permissions, network restrictions, or deletion of the resource—it will populate the environment variable with the raw reference string instead of failing the deployment or throwing an exception.

Step-by-Step Solution

1
Analyze the configuration and the observed behavior where the application receives the raw `@Microsoft.KeyVault(...)` reference string instead of the secret value.
Confirm that the syntax of the reference is correct and that the App Service is failing to resolve the reference at runtime.
When a Key Vault reference cannot be resolved due to configuration or access issues, App Service defaults to passing the raw reference string to the application code.
2
Verify the syntax of the Key Vault reference: `@Microsoft.KeyVault(VaultName=kv-prod-westus;SecretName=DbConnectionString)`.
The syntax is valid because it specifies both the correct vault name and secret name, and the secret version is optional.
This rules out syntax errors as the cause of the failure.
3
Check the authentication and authorization configuration between the App Service and the Key Vault.
The App Service has a system-assigned managed identity enabled, but it needs explicit authorization to read secrets.
For the App Service to retrieve the secret, its managed identity must be granted the 'Get' secret permission via Key Vault access policies or Azure RBAC (Key Vault Secrets User role).

Key Concept

Key Vault references in Azure App Service require correct syntax and appropriate read permissions ('Get' secret permission) granted to the app's managed identity in the Key Vault.
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic