You are developing a secure containerized application that will run in Azure Container Instances (ACI). The container needs to read a database connection string from an Azure Key Vault at startup. To follow security best practices, the container group must authenticate to the Key Vault without storing any credentials in the deployment template or container image. Additionally, the identity's lifecycle must be tied directly to the lifecycle of the container group, meaning the identity is automatically deleted when the container group is deleted. Which identity configuration should you apply to the container group?
- A system-assigned managed identity enabled on the container groupCevap
- BA user-assigned managed identity assigned to the container group
- CA Key Vault access policy that grants GET permissions to the container group's public IP address
- DA system-assigned managed identity enabled on the parent resource group
Cevap
A system-assigned managed identity enabled on the container group
The correct option is the system-assigned managed identity. A system-assigned managed identity is created directly on the Azure Container Instances (ACI) container group. It is tied to the lifecycle of that specific container group, meaning it is automatically created when the container group is provisioned and automatically deleted when the container group is deleted.
Adım Adım Çözüm
Anahtar Kavram
Azure Container Instances supports managed identities for authenticating to other Microsoft Entra-protected resources such as Azure Key Vault. A system-assigned managed identity is tied to the lifecycle of the resource.