You are configuring a deployment to Azure Container Instances (ACI). The container must pull its image from a private Azure Container Registry (ACR) and retrieve its database connection strings from Azure Key Vault during startup. You need to configure the authentication and access policies to ensure secure and successful deployment. Which two configurations are required to meet these requirements? (Choose two.)
- Configure a user-assigned managed identity for the container group and grant it the AcrPull role on the private Azure Container Registry.Cevap
- Grant the container group's managed identity GET permission on Key Vault Secrets in the Key Vault access policies.Cevap
- CConfigure a system-assigned managed identity for the container group and grant it the AcrPull role on the private Azure Container Registry.
- DGrant the Azure Container Registry service principal GET permission on Key Vault Secrets in the Key Vault access policies.
- EInclude the az acr login command in the container's startup script to authenticate and pull the image from the registry.
Cevap
Configure a user-assigned managed identity for the container group with the AcrPull role on the Azure Container Registry, and grant the container group's managed identity GET permission on Secrets in the Key Vault access policies.
To deploy an ACI container group that pulls from a private ACR and retrieves secrets from Key Vault, a user-assigned managed identity is required for the ACR pull since the identity must exist before container group creation. Additionally, that same managed identity must be granted GET permission in Key Vault access policies to allow the application code to retrieve database connection strings at startup.
Adım Adım Çözüm
Anahtar Kavram
Configuring private registry access and Key Vault integration for Azure Container Instances using managed identities.