An organization is transitioning its Azure resources to use Azure Role-Based Access Control (RBAC) instead of Key Vault access policies. A developer needs to ensure that an Azure Web App can retrieve secrets from a Key Vault named kv-prod using its system-assigned managed identity.
Which configuration change must be performed to allow the Web App to retrieve the secrets?
- ASet the Key Vault permission model to Azure RBAC, and assign the Key Vault Reader role to the Web App's managed identity.
- Set the Key Vault permission model to Azure RBAC, and assign the Key Vault Secrets User role to the Web App's managed identity.Cevap
- CSet the Key Vault permission model to Vault access policy, and assign the Reader role to the Web App's managed identity.
- DSet the Key Vault permission model to Azure RBAC, and configure a user-assigned managed identity for the Web App, as system-assigned managed identities do not support RBAC.
Cevap
Set the Key Vault permission model to Azure RBAC, and assign the Key Vault Secrets User role to the Web App's managed identity.
Setting the Key Vault permission model to Azure RBAC and assigning the Key Vault Secrets User role is correct because the Key Vault Secrets User role provides the necessary data-plane permissions to read secret values, and system-assigned managed identities are fully compatible with Azure RBAC.
Adım Adım Çözüm
Anahtar Kavram
Key Vault access authorization model transition and data-plane role assignment
Tahmini Süre:1m 0s