Examkin

Question

Difficulty: HardSecure App Configuration and Key Vault References

A Python-based background worker runs in an Azure Function App named func-worker-prod. The Function App needs to retrieve a database password from an Azure Key Vault named kv-secrets-prod.

You configure a user-assigned managed identity named id-worker-prod for the Function App and grant it the Key Vault Secrets User role on kv-secrets-prod. The DbPassword application setting in the Function App is currently configured as follows:

@KeyVault(SecretUri=https://kv-secrets-prod.vault.azure.net/secrets/db-password)

At runtime, the Python worker reads the DbPassword environment variable as the plain text reference string rather than the actual secret value. Which two configuration updates must you perform to ensure the Key Vault reference resolves correctly?

  1. Create a new application setting named keyVaultReferenceIdentity and set its value to the resource ID of the user-assigned managed identity.Answer
  2. Update the value of the DbPassword application setting to @Microsoft.KeyVault(SecretUri=https://kv-secrets-prod.vault.azure.net/secrets/db-password/).Answer
  3. C
    Create a new application setting named keyVaultReferenceIdentity and set its value to the client ID of the user-assigned managed identity.
  4. D
    Update the value of the DbPassword application setting to @Microsoft.KeyVault(SecretUri=https://kv-secrets-prod.vault.azure.net/secrets/db-password).
  5. E
    Create a new application setting named AZURE_CLIENT_ID and set its value to the client ID of the user-assigned managed identity.
  6. F
    Grant the user-assigned managed identity the Key Vault Contributor role on kv-secrets-prod.

Answer

Create a new application setting named keyVaultReferenceIdentity set to the identity's resource ID, and update the DbPassword setting to use the correct @Microsoft.KeyVault syntax with a trailing slash.
To successfully resolve a Key Vault reference using a user-assigned managed identity in Azure Functions, you must update the reference to use the correct syntax and point the App Service runtime to the correct identity. The correct syntax must begin with @Microsoft.KeyVault and include a trailing slash at the end of the URL if no secret version is specified. Additionally, you must add the keyVaultReferenceIdentity application setting and set it to the resource ID of the user-assigned managed identity.

Step-by-Step Solution

1
Correct the Key Vault reference syntax.
Changing the prefix from @KeyVault to @Microsoft.KeyVault and adding a trailing slash since no version is specified.
The App Service runtime requires the full @Microsoft.KeyVault prefix and a trailing slash for versionless secret URIs to correctly parse and resolve the reference.
2
Configure the keyVaultReferenceIdentity setting.
Adding the keyVaultReferenceIdentity setting with the user-assigned identity's resource ID.
If an app has only a user-assigned managed identity, the App Service platform needs the resource ID of that identity specified in the keyVaultReferenceIdentity setting to fetch the secret from Key Vault.

Key Concept

Key Vault references in App Service and Azure Functions require correct syntax (including trailing slash for versionless URIs) and explicit configuration of the keyVaultReferenceIdentity setting when using user-assigned managed identities.
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic