Examkin

Soru

Zorluk: OrtaDefine API Management Policies

An enterprise application uses Azure API Management (APIM) to route requests to a secure backend microservice. The backend microservice requires a specific API key passed via an HTTP header named X-Backend-Key. To secure the credential, the API key is stored as a secret in Azure Key Vault. You have already created an APIM named value named BackendApiKey that references this secret. APIM must retrieve the secret dynamically from the Key Vault using its system-assigned managed identity. Which configuration and policy placement will successfully inject the API key header into the request sent to the backend?

  1. A
    Place a set-header policy in the outbound section of the policy definition using the {{BackendApiKey}} named value, and ensure the API Management system-assigned managed identity is granted the Key Vault Secrets User role in Azure Key Vault.
  2. Place a set-header policy in the inbound section of the policy definition using the {{BackendApiKey}} named value, and ensure the API Management system-assigned managed identity is granted the Key Vault Secrets User role in Azure Key Vault.Cevap
  3. C
    Place a set-header policy in the inbound section of the policy definition using the {{BackendApiKey}} named value, and ensure a user-assigned managed identity is granted the Key Vault Secrets User role in Azure Key Vault while the named value is configured to use the system-assigned managed identity.
  4. D
    Place a set-header policy in the inbound section of the policy definition using the {{BackendApiKey}} named value, without granting any explicit Key Vault permissions to the API Management system-assigned managed identity, as API Management instances possess default read privileges to Key Vault resources within the same Azure subscription.

Cevap

Place a set-header policy in the inbound section of the policy definition using the {{BackendApiKey}} named value, and ensure the API Management system-assigned managed identity is granted the Key Vault Secrets User role in Azure Key Vault.
Placing the set-header policy in the inbound section modifies the request headers before they are forwarded to the backend service. Referencing the named value via the double curly braces syntax retrieves the secret from Azure Key Vault, which succeeds because the system-assigned managed identity is assigned the Key Vault Secrets User role.

Adım Adım Çözüm

1
Determine the correct policy section for modifying requests forwarded to the backend.
The inbound section must be used because it processes the request prior to calling the backend service.
Outbound and other sections run too late or are for different stages of the gateway pipeline.
2
Identify the correct referencing format for named values in API Management policies.
Use the curly brace notation format, which in this case is {{BackendApiKey}}.
This tells API Management to look up the named value and retrieve its mapped value, which points to the Key Vault secret.
3
Assign the necessary permissions for Key Vault retrieval via the system-assigned managed identity.
Grant the API Management system-assigned managed identity the Key Vault Secrets User role or Get secret permission in the target Key Vault.
Without explicit permissions, the Key Vault request will be denied, preventing the named value from resolving.

Anahtar Kavram

API Management policy configuration for inbound request header injection using Key Vault named values backed by system-assigned managed identities.
Bu soruyu puanla

Konular

Define API Management Policies

Bu konudan daha fazla soru