Soru

Zorluk: OrtaConfigure Azure Application Gateway

You plan to configure an Azure Application Gateway v2 to use an SSL certificate stored in an Azure Key Vault. You need to configure the components in the correct sequence to ensure that the Application Gateway can retrieve the certificate and secure incoming HTTPS traffic. Which sequence of steps should you perform?

  1. 1Create a user-assigned managed identity.
  2. 2Grant the managed identity get permissions for secrets in the Key Vault.
  3. 3Associate the managed identity with the Application Gateway.
  4. 4Configure the HTTPS listener on the Application Gateway to reference the Key Vault certificate.

Cevap

The correct sequence is to first create the user-assigned managed identity, then grant it secrets get permissions in the Key Vault, next associate the identity with the Application Gateway, and finally configure the HTTPS listener to reference the Key Vault certificate.
To configure an Application Gateway with an SSL certificate stored in Key Vault, you must first create a user-assigned managed identity. The identity must then be granted permissions to access Key Vault secrets (certificates are stored as secrets). After that, you associate the managed identity with the Application Gateway so it can use the identity. Finally, you configure the HTTPS listener to reference the certificate URI in Key Vault, which validates successfully because the gateway now has an identity with the required access.

Adım Adım Çözüm

1
Create a user-assigned managed identity in Azure.
A new managed identity resource is created and assigned a client ID.
An identity is required for the Application Gateway to authenticate to the Azure Key Vault securely.
2
Assign the Key Vault Secrets User role (or equivalent access policy) to the managed identity.
The managed identity is granted permission to read secrets from the Key Vault.
Since Key Vault certificates are retrieved as secrets by the Application Gateway, the identity must have read/get access.
3
Update the Application Gateway to associate it with the user-assigned managed identity.
The Application Gateway resource is configured with the identity's resource ID.
This allows the Application Gateway to act on behalf of the managed identity when calling Key Vault.
4
Add or update the HTTPS listener on the Application Gateway to point to the Key Vault certificate URI.
The Application Gateway retrieves the certificate and binds it to the HTTPS listener.
This completes the setup, enabling SSL/TLS termination on the Application Gateway using the managed certificate.

Anahtar Kavram

Integrating Azure Application Gateway with Azure Key Vault using managed identities for SSL/TLS certificates.
Bu soruyu puanla