Soru

Zorluk: OrtaRun Containerized Solutions using Azure Container Instances

An application running inside an Azure Container Instances (ACI) container group is configured to use a system-assigned managed identity to access an Azure Key Vault. When the application attempts to retrieve a secret, it receives an HTTP 403 Forbidden error. You confirm that the system-assigned managed identity is enabled on the container group. Which action must you perform to resolve the access error?

  1. A
    Modify the container group's YAML configuration to use a user-assigned managed identity, because system-assigned managed identities cannot be granted permissions to Key Vault.
  2. B
    Configure the container group deployment by setting the imageRegistryCredentials property to include the Key Vault client credentials.
  3. Configure an access policy or Azure Role-Based Access Control (RBAC) role assignment on the Key Vault that grants 'Get' permission for secrets to the container group's identity.Cevap
  4. D
    Update the application's configuration by defining a Key Vault reference using the @Microsoft.KeyVault(SecretUri=...) syntax in the container environment variables.

Cevap

Configure an access policy or Azure Role-Based Access Control (RBAC) role assignment on the Key Vault that grants 'Get' permission for secrets to the container group's identity.
The HTTP 403 Forbidden error indicates that authentication was successful (the container has an identity), but authorization failed because the Key Vault access policies or RBAC roles do not permit the system-assigned managed identity to access the secrets. Granting 'Get' permission to the identity resolves the issue.

Adım Adım Çözüm

1
Identify the authentication mechanism
The ACI container group is authenticated with a system-assigned managed identity.
We must understand how ACI identifies itself before checking authorization.
2
Verify Key Vault authorization settings
The identity exists, but does not have permissions to access the secrets inside the Key Vault.
Authentication is successful but authorization is failing with HTTP 403 Forbidden.
3
Grant the required permissions
Add a Key Vault access policy or Azure RBAC role assignment allowing 'Get' operations for secrets to the container group's managed identity.
This grants the system-assigned identity the required authorization to retrieve the secret.

Anahtar Kavram

Assigning Key Vault permissions to an ACI system-assigned managed identity
Tahmini Süre:1m 30s
Bu soruyu puanla