Examkin

Soru

Zorluk: OrtaConfigure Azure App Services

You have an Azure App Service web app named WebApp1 and an Azure Key Vault named Vault1. You need to store a database connection string in Vault1 as a secret and configure WebApp1 to securely retrieve the connection string without exposing the raw secret value in the App Service configuration. Which sequence of steps should you perform to complete this configuration?

  1. 1Enable a system-assigned managed identity for WebApp1.
  2. 2Assign the Key Vault Secrets User role to WebApp1's managed identity on Vault1.
  3. 3Retrieve the Secret Identifier URL of the database connection string secret from Vault1.
  4. 4Create an application setting in WebApp1 that references the retrieved Secret Identifier using the key vault reference syntax.

Cevap

To securely reference a Key Vault secret in WebApp1, you must first enable a system-assigned managed identity for WebApp1, then assign the Key Vault Secrets User role to WebApp1's managed identity on Vault1, retrieve the Secret Identifier URL of the database connection string secret from Vault1, and finally create an application setting in WebApp1 that references the Secret Identifier using the key vault reference syntax.
The correct sequence starts with enabling the system-assigned managed identity because the identity must exist in Microsoft Entra ID before any access permissions can be granted. Once created, the Key Vault Secrets User role must be assigned to the identity so that WebApp1 can read secrets. Next, the Secret Identifier URL is retrieved from Vault1 to point to the correct secret. Finally, the App Service application settings must be updated with this URI using the Key Vault reference syntax so that the runtime can fetch the secret.

Adım Adım Çözüm

1
Enable a system-assigned managed identity for WebApp1.
A service principal is registered in Microsoft Entra ID for the web app, allowing it to authenticate to other Azure services.
An identity must exist before permissions can be assigned to it.
2
Assign the Key Vault Secrets User role to WebApp1's managed identity on Vault1.
The web app's managed identity is granted read access to secrets in Vault1.
By default, App Services do not have permission to read secrets from Key Vault; authorization is required.
3
Retrieve the Secret Identifier URL of the database connection string secret from Vault1.
You obtain the specific URI pointing to the secret version in Key Vault.
The App Service application setting configuration requires this URI to resolve the secret value.
4
Create an application setting in WebApp1 that references the retrieved Secret Identifier using the key vault reference syntax.
WebApp1 resolves the secret at runtime and exposes it as an environment variable to the application code.
The `@Microsoft.KeyVault` syntax tells the App Service runtime to fetch the secret on behalf of the application.

Anahtar Kavram

Azure App Service Key Vault references allow web apps to pull secrets from Key Vault at runtime using managed identities, keeping credentials out of the application configuration.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Configure Azure App Services

Bu konudan daha fazla soru