You are deploying an ASP.NET Core web application to an Azure App Service. The application must securely retrieve a database password stored as a secret in Azure Key Vault. You decide to use a system-assigned managed identity and Key Vault references to configure the application.
Which sequence of steps should you perform to configure the Azure resources and the App Service to resolve the secret?
- 1Enable the system-assigned managed identity on the Azure App Service instance.
- 2Assign the Key Vault Secrets User role to the App Service's managed identity on the Azure Key Vault.
- 3Retrieve the Secret Identifier (URI) of the database password secret from the Key Vault.
- 4Add a new application setting in the App Service with a value formatted as @Microsoft.KeyVault(SecretUri=...).
Answer
The correct order of steps is: 1) Enable the system-assigned managed identity on the Azure App Service instance. 2) Assign the Key Vault Secrets User role to the App Service's managed identity on the Azure Key Vault. 3) Retrieve the Secret Identifier (URI) of the database password secret from the Key Vault. 4) Add a new application setting in the App Service with a value formatted as @Microsoft.KeyVault(SecretUri=...).
The correct order establishes the security identity first, then applies the necessary Key Vault role permissions to it, retrieves the required secret identifier, and finally sets up the application configuration using the Key Vault reference syntax.
Step-by-Step Solution
Key Concept
To securely reference Azure Key Vault secrets from App Service without code changes, you must enable a managed identity on the app, grant it the Key Vault Secrets User role on the Key Vault, and configure the app setting using the @Microsoft.KeyVault(SecretUri=...) syntax.