Examkin

Soru

Zorluk: KolaySystem-Assigned and User-Assigned Managed Identities

You need to configure an Azure App Service web app to retrieve secrets from an Azure Key Vault by using a user-assigned managed identity. Which sequence of steps should you perform? To answer, arrange the actions in the correct order.

  1. 1Create a user-assigned managed identity in your Azure subscription.
  2. 2Associate the user-assigned managed identity with the Azure App Service web app.
  3. 3Assign a Key Vault access policy or Azure RBAC role to the user-assigned managed identity.
  4. 4Modify the web app code to authenticate using the user-assigned managed identity's client ID.

Cevap

The correct sequence of steps is: first, create the user-assigned managed identity; second, associate the user-assigned managed identity with the Azure App Service web app; third, assign the role or access policy to the identity on the Key Vault; and fourth, configure the application code to authenticate using the client ID of the user-assigned managed identity.
To successfully authenticate an App Service using a user-assigned managed identity, you must first provision the identity resource. Once created, it must be linked to the web app so the runtime environment can access its credentials. You then grant the identity permissions on the target Key Vault via role-based access control or access policies. Finally, since multiple user-assigned identities can exist on a resource, you must explicitly supply the client ID in your code configuration (e.g., using DefaultAzureCredentialOptions) to specify which identity to use.

Adım Adım Çözüm

1
Create the user-assigned managed identity.
A standalone Azure identity resource is provisioned with its own client ID.
Since user-assigned identities exist independently of resources, they must be created before they can be configured or assigned.
2
Associate the identity with the App Service web app.
The App Service web app is configured to use the user-assigned identity.
This allows the host environment of the App Service to present the identity's credentials when requesting tokens.
3
Configure permissions on the Key Vault for the identity.
The identity is authorized to access Key Vault secrets.
By default, identities have no access to Azure resources; authorization must be explicitly granted.
4
Update the web app application code.
The code successfully authenticates and retrieves secrets.
Because multiple user-assigned identities can be associated with a single resource, the code must specify which user-assigned identity to use by providing its client ID to the credential class.

Anahtar Kavram

Provisioning, assigning, and authorizing a user-assigned managed identity to access Azure resources.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

System-Assigned and User-Assigned Managed Identities

Bu konudan daha fazla soru