An organization is provisioning a new Azure API Management (APIM) instance. You must configure the APIM instance to retrieve a backend API key stored as a secret in an Azure Key Vault. You have already enabled a system-assigned managed identity on the APIM instance. Which action should you perform next to allow APIM to retrieve the secret?
- Grant the system-assigned managed identity of the APIM instance the Key Vault Secrets User role or GET permission in the Key Vault, and then create an APIM Named Value that references the Key Vault secret.Cevap
- BCreate an APIM Named Value that references the Key Vault secret URI directly, because enabling the system-assigned managed identity automatically inherits read access to all Key Vaults in the same resource group.
- CCreate a new user-assigned managed identity, assign it the Key Vault Secrets User role, and configure the backend service's app registration to reference this identity instead of the APIM instance.
- DDefine a secret retrieval policy using the Key Vault secret URI and place it inside the <outbound> section of the global API policy configuration.
Cevap
Grant the system-assigned managed identity of the APIM instance the Key Vault Secrets User role or GET permission in the Key Vault, and then create an APIM Named Value that references the Key Vault secret.
To retrieve and use a secret key from Key Vault securely, the API Management instance's system-assigned managed identity must have explicit read access (such as Key Vault Secrets User role or GET permission on secrets) in the Key Vault. Once access is authorized, a Named Value can be configured in API Management referencing the Key Vault secret URI, allowing APIM to fetch the secret dynamically.
Adım Adım Çözüm
Anahtar Kavram
Azure API Management Named Values integration with Azure Key Vault using Managed Identities