Examkin

Soru

Zorluk: OrtaSecure App Configuration and Key Vault References

You are deploying a .NET web application to an Azure App Service. The application is configured to retrieve its configuration settings from an Azure App Configuration store named appconf-prod. Some settings, such as database credentials, are stored as Key Vault references pointing to secrets in an Azure Key Vault named kv-prod. The App Service has a system-assigned managed identity enabled. At runtime, the application loads configuration values from appconf-prod but receives the raw JSON metadata of the Key Vault references instead of the actual secret values. Which of the following actions must you perform to resolve this issue and successfully retrieve the secret values? (Select THREE correct actions.)

  1. Grant the App Service's system-assigned managed identity the App Configuration Data Reader role on the appconf-prod store.Cevap
  2. Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the kv-prod Key Vault.Cevap
  3. Configure the application's configuration builder to call ConfigureKeyVault and pass a token credential such as DefaultAzureCredential.Cevap
  4. D
    Grant the App Configuration instance a system-assigned managed identity and assign that identity the Key Vault Secrets User role on the kv-prod Key Vault.
  5. E
    Change the value of the key-value pairs in the App Configuration store to use the App Service reference syntax: @Microsoft.KeyVault(SecretUri=https://...).

Cevap

To resolve the raw JSON metadata issue and retrieve the actual secret values, you must grant the App Service's managed identity the App Configuration Data Reader role on the configuration store, grant the same managed identity the Key Vault Secrets User role on the Key Vault, and configure the application code using ConfigureKeyVault with an appropriate credential like DefaultAzureCredential.
The system-assigned managed identity of the App Service must have read permissions for both the App Configuration store (App Configuration Data Reader) and the Key Vault (Key Vault Secrets User). In addition, the application's startup code must be updated to call ConfigureKeyVault on the configuration builder, passing a credential like DefaultAzureCredential so the SDK can resolve the references at startup.

Adım Adım Çözüm

1
Configure application code to resolve Key Vault references.
The App Configuration provider client is instructed to detect and fetch Key Vault references using the provided credentials.
By default, the SDK only reads key-value metadata. Enabling ConfigureKeyVault with DefaultAzureCredential enables client-side resolution of Key Vault references.
2
Assign the App Configuration Data Reader role to the App Service managed identity on the App Configuration store.
The application can successfully authenticate and read the configurations (including Key Vault reference metadata) from the store.
The managed identity requires read permissions on the App Configuration store to fetch configuration keys and values.
3
Assign the Key Vault Secrets User role to the App Service managed identity on the Key Vault.
The application can fetch the actual secret values from Key Vault when resolving the references.
Since Key Vault references are resolved client-side by the application, the application's managed identity must have secret read access on the target Key Vault.

Anahtar Kavram

Key Vault references in Azure App Configuration are resolved client-side by the application's SDK. This requires that the application's identity has read permissions to both the App Configuration store and the target Key Vault, and that the SDK is configured to resolve the references.
Bu soruyu puanla

Konular

Secure App Configuration and Key Vault References

Bu konudan daha fazla soru