Examkin

Question

Difficulty: Very hardSystem-Assigned and User-Assigned Managed Identities

You are deploying a C# ASP.NET Core web application to an Azure App Service. The application must retrieve secrets from two distinct Azure Key Vaults:

1. `kv-finance`: Contains highly sensitive financial credentials and must only be accessible by this specific App Service instance. Access must be automatically revoked if the App Service is deleted.
2. `kv-shared`: Contains shared configuration data and is accessed by multiple App Service instances across the resource group.

You have created a user-assigned managed identity named `id-shared` for shared resource access. You need to configure the identities and implement the authentication code using the `Azure.Identity` SDK and `DefaultAzureCredential` class.

Which two configuration steps should you implement to satisfy the requirements? (Select two.)

  1. Configure the identity property of the App Service in your ARM template with a type of SystemAssigned, UserAssigned and list the resource ID of id-shared under userAssignedIdentities.Answer
  2. For accessing kv-shared, instantiate the SecretClient using: new SecretClient(new Uri("https://kv-shared.vault.azure.net/"), new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = "<user-assigned-client-id>" }));Answer
  3. C
    Set the AZURE_CLIENT_ID environment variable of the App Service to the client ID of id-shared, and instantiate both clients using new DefaultAzureCredential() without parameters.
  4. D
    Configure the identity property of the App Service in your ARM template with a type of SystemAssignedIdentity, UserAssignedIdentity.

Answer

Configure the App Service identity property in the ARM template using the type 'SystemAssigned, UserAssigned' while listing the resource ID of the user-assigned identity, and instantiate the client for the shared Key Vault by passing DefaultAzureCredentialOptions with the user-assigned identity's client ID.
To satisfy the requirements, the App Service needs to be provisioned with both system-assigned and user-assigned managed identities, which requires setting the ARM identity type to 'SystemAssigned, UserAssigned' and linking the user-assigned identity. In the application code, the default behavior of DefaultAzureCredential is to attempt authentication via the system-assigned managed identity first. To target the user-assigned identity for the shared Key Vault, the client ID of the user-assigned identity must be explicitly configured using DefaultAzureCredentialOptions.

Step-by-Step Solution

1
Determine the lifecycle requirements for both Key Vaults.
The finance Key Vault requires a system-assigned managed identity since its access must be revoked automatically upon resource deletion. The shared Key Vault requires a user-assigned managed identity to facilitate shared access across multiple instances.
This aligns identity selection with resource lifecycle boundaries.
2
Define the identity configuration in the ARM template.
Configure the App Service resource with identity type 'SystemAssigned, UserAssigned' and reference the user-assigned identity's resource ID in the userAssignedIdentities block.
This enables both system-assigned and user-assigned managed identities on the App Service instance.
3
Configure the .NET code for the database-specific Key Vault (kv-finance).
Instantiate the client using 'new DefaultAzureCredential()'.
By default, when no client ID is explicitly provided, DefaultAzureCredential attempts to use the system-assigned managed identity.
4
Configure the .NET code for the shared Key Vault (kv-shared).
Instantiate the client using 'new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = "<client-id>" })'.
Specifying the client ID targets the user-assigned managed identity, ensuring it does not default to the system-assigned managed identity.

Key Concept

Configuring co-existing system-assigned and user-assigned managed identities and resolving client identities programmatically using DefaultAzureCredential.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic