An organization requires an Azure API Management (APIM) instance to securely retrieve a database password from an Azure Key Vault secret. The password will be exposed to API policies via a Named Value. You must use a user-assigned managed identity named apim-identity to authenticate from the APIM instance to the Key Vault.
Which two configurations should you implement to achieve this? (Choose two.)
- Associate the apim-identity user-assigned managed identity with the APIM instance.Cevap
- Grant the apim-identity user-assigned managed identity the Secret Get permission in the Key Vault access policies or Azure Role-Based Access Control (RBAC).Cevap
- CEnable the system-assigned managed identity on the APIM instance and assign it the Secret Get permission on the Key Vault.
- DGrant the apim-identity user-assigned managed identity the Secret List and Secret Backup permissions on the Key Vault.
Cevap
To configure the APIM instance to retrieve the secret from the Key Vault using a user-assigned managed identity, you must associate the user-assigned managed identity (apim-identity) with the APIM instance, and grant this identity the Secret Get permission on the Key Vault.
To retrieve a secret value from Key Vault for an APIM Named Value using a user-assigned managed identity, two configuration steps are required: 1) Associate the user-assigned managed identity with the APIM instance so it is available for use. 2) Grant the user-assigned managed identity the Secret Get permission on the Key Vault access policies or Azure RBAC so it has permission to read the secret value.
Adım Adım Çözüm
Anahtar Kavram
Configuring Azure API Management Named Values to retrieve secrets from Key Vault using a user-assigned managed identity.