Examkin

Soru

Zorluk: ZorConfigure Azure App Service Web Apps

You configure a user-assigned managed identity for an Azure App Service web app. You want the web app to retrieve a database password from Azure Key Vault by using a Key Vault reference in the App Settings. The web app has the system-assigned managed identity disabled. The Key Vault reference is configured as DatabasePassword = @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/db-password/). The web app fails to retrieve the secret because it attempts to use a system-assigned identity. Which action should you perform to resolve this issue and allow the web app to retrieve the password?

  1. Configure the web app's keyVaultReferenceIdentity setting to the Resource Manager resource ID of the user-assigned managed identity.Cevap
  2. B
    Configure the web app's keyVaultReferenceIdentity setting to the client ID of the user-assigned managed identity.
  3. C
    Modify the Key Vault reference syntax to append the identity's client ID, such as @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/db-password/;identityClientId=id).
  4. D
    Grant the user-assigned managed identity the Key Vault Secrets User role, without modifying any configurations on the App Service web app.

Cevap

Configure the web app's keyVaultReferenceIdentity setting to the Resource Manager resource ID of the user-assigned managed identity.
To resolve Key Vault references using a user-assigned managed identity, the App Service web app must have its keyVaultReferenceIdentity setting configured with the full Resource Manager resource ID of that user-assigned identity. This is because App Service defaults to using the system-assigned identity for reference resolution, and when it is disabled, the resolution fails unless the specific user-assigned identity is explicitly configured at the App Service level.

Adım Adım Çözüm

1
Determine that when system-assigned managed identity is disabled, the App Service does not automatically resolve Key Vault references using user-assigned identities.
Identify that the resolving identity must be explicitly configured on the web app.
By default, App Service attempts to use the system-assigned identity for reference resolution.
2
Select the correct configuration setting and identifier type required by Azure App Service.
Identify that the keyVaultReferenceIdentity property must be set to the Resource Manager resource ID of the user-assigned managed identity.
The keyVaultReferenceIdentity setting expects the full resource ID path rather than the client ID or principal ID.
3
Update the site configuration parameters of the App Service web app.
Set keyVaultReferenceIdentity to the user-assigned identity resource ID, allowing reference resolution to succeed.
This updates the App Service control plane to use the specified user-assigned identity when performing Secret Get operations.

Anahtar Kavram

User-assigned managed identity configuration for App Service Key Vault references
Bu soruyu puanla

Konular

Configure Azure App Service Web Apps

Bu konudan daha fazla soru