Examkin

Soru

Zorluk: ZorCreate and Configure Azure Functions

You configure an application setting in an Azure Function App to reference a database connection string stored in Azure Key Vault using the syntax: `@Microsoft.KeyVault(VaultName=kv-prod;SecretName=conn-string)`. During testing, the function fails to connect to the database. You inspect the function logs and discover that the environment variable for the connection string contains the literal string `@Microsoft.KeyVault(VaultName=kv-prod;SecretName=conn-string)` instead of the resolved secret value. What is the most likely cause of this issue?

  1. The Function App's managed identity has not been granted permissions to read secrets from the Key Vault.Cevap
  2. B
    The Key Vault reference syntax is invalid because the secret version was not specified in the parameters.
  3. C
    Key Vault references require a user-assigned managed identity, but the Function App is configured with a system-assigned managed identity.
  4. D
    Key Vault references are only supported in Dedicated (App Service) hosting plans, and the Function App is currently deployed on a Consumption plan.

Cevap

The Function App's managed identity has not been granted permissions to read secrets from the Key Vault.
The correct answer is correct because when a Key Vault reference cannot be resolved by the runtime, it returns the raw reference string instead of the secret. The most common cause for this is that the Azure Function App's managed identity has not been granted the 'Get' secret permission in the Key Vault access policies or the 'Key Vault Secrets User' role in Azure role-based access control (RBAC).

Adım Adım Çözüm

1
Analyze the behavior of unresolved Key Vault references in Azure Functions.
When a Key Vault reference cannot be resolved by the runtime, the application setting returns the raw reference string (e.g., starting with `@Microsoft.KeyVault`) rather than throwing a runtime exception.
This behavior helps developers detect configuration issues, such as missing permissions or incorrect URIs, by examining the returned value.
2
Verify key requirements for resolving Key Vault references.
The reference requires a configured managed identity (system-assigned or user-assigned) and appropriate access permissions (such as Key Vault Secrets User or a custom policy with Get secrets permissions). The secret version is optional, and the feature is supported across all hosting plans.
Eliminating options related to versioning, hosting plan restrictions, and identity type constraints isolates the authorization policy as the missing link.
3
Select the option that matches the authorization failure.
The option indicating that the managed identity lacks permissions to read secrets from the Key Vault is the correct answer.
Without the correct permissions, the Function App cannot fetch the secret value, resulting in the literal reference string being exposed at runtime.

Anahtar Kavram

Azure Functions Security Configuration and Key Vault References
Bu soruyu puanla

Konular

Create and Configure Azure Functions

Bu konudan daha fazla soru