Examkin

Soru

Zorluk: ZorAzure Key Vault Secret, Key, and Certificate Management

An organization hosting a containerized API on Azure App Service (webapp-prod) needs to access database connection strings stored in Azure Key Vault (kv-prod). The Key Vault uses the Azure Role-Based Access Control (Azure RBAC) permission model. To comply with security policies, the API must authenticate using a user-assigned managed identity named id-prod instead of a system-assigned identity. Which three actions should you perform to configure the application and Key Vault to retrieve the secrets using the user-assigned managed identity? (Select three.)

  1. Assign the Key Vault Secrets User role to the id-prod managed identity at the key vault scope.Cevap
  2. Associate the id-prod managed identity with webapp-prod by adding it to the App Service's identity configuration.Cevap
  3. Set the keyVaultReferenceIdentity property of webapp-prod to the Resource ID of id-prod.Cevap
  4. D
    Assign the Reader role to the id-prod managed identity at the key vault scope.
  5. E
    Set the keyVaultReferenceIdentity property of webapp-prod to the Application (Client) ID of id-prod.
  6. F
    Assign the Key Vault Contributor role to the id-prod managed identity at the key vault scope.

Cevap

To configure Key Vault secret retrieval using a user-assigned identity, you must assign the Key Vault Secrets User role to the identity, associate the identity with the App Service, and set the keyVaultReferenceIdentity property of the App Service to the identity's Resource ID.
To retrieve secrets from a Key Vault configured with Azure RBAC using a user-assigned managed identity, you must first assign the Key Vault Secrets User role to the identity to grant data plane read access. Second, you must associate the user-assigned identity with the App Service so that the host environment can access the identity. Finally, you must configure the App Service to use this specific identity for resolving Key Vault references by setting the keyVaultReferenceIdentity property to the Azure Resource Manager (ARM) Resource ID of the identity.

Adım Adım Çözüm

1
Assign the appropriate Azure RBAC role to the managed identity.
The user-assigned identity id-prod is granted the Key Vault Secrets User role.
Key Vault RBAC separates management plane roles from data plane roles. The identity needs data plane permissions to retrieve secret values.
2
Associate the user-assigned identity with the App Service web app.
The App Service is configured to load and present the id-prod identity during credential requests.
An App Service cannot use a user-assigned managed identity until the identity is explicitly added to the app's resource configuration.
3
Configure Key Vault references to use the user-assigned identity.
The keyVaultReferenceIdentity App Service property is set to the Resource ID of id-prod.
By default, App Service Key Vault references use the system-assigned managed identity. To use a user-assigned identity, the app must be instructed which identity to use via its Resource ID.

Anahtar Kavram

Azure Key Vault Secret Management with Azure RBAC and User-Assigned Managed Identity
Bu soruyu puanla

Konular

Azure Key Vault Secret, Key, and Certificate Management

Bu konudan daha fazla soru