Examkin

Soru

Zorluk: OrtaConfigure Azure App Service Web Apps

You are deploying a web application to Azure App Service named app-checkout. You want to configure the web app to access a database connection string stored in an Azure Key Vault named vault-checkout using a Key Vault reference.

You perform the following actions:
1. Enable a system-assigned managed identity for app-checkout.
2. In the App Service App Settings, add a setting named DbConnectionString with the value @Microsoft.KeyVault(SecretUri=https://vault-checkout.vault.azure.net/secrets/db-conn).

At runtime, the application fails to connect to the database, and the App Service configuration portal shows the status of the Key Vault reference as 'Access Denied'.

Which of the following actions is required to resolve this issue?

  1. Configure an access policy or Azure role-based access control (RBAC) role assignment on the Key Vault to grant the web app's system-assigned managed identity the Get secret permission.Cevap
  2. B
    Configure the web app's keyVaultReferenceIdentity setting to specify the system-assigned managed identity.
  3. C
    Grant the App Service Plan's service principal the Get secret permission on the Key Vault's access policies.
  4. D
    Modify the application setting to use the value @KeyVault(SecretUri=https://vault-checkout.vault.azure.net/secrets/db-conn).

Cevap

Configure an access policy or Azure role-based access control (RBAC) role assignment on the Key Vault to grant the web app's system-assigned managed identity the Get secret permission.
The correct answer is to configure an access policy or Azure RBAC role assignment on the Key Vault to grant the web app's system-assigned managed identity the Get secret permission. When an App Service web app is configured with a Key Vault reference, it uses its managed identity to authenticate and fetch the secret. An 'Access Denied' error indicates that the web app's identity is authenticated but does not have permission to read the secret.

Adım Adım Çözüm

1
Identify the identity used by the web app for Key Vault references.
The web app is configured to use its system-assigned managed identity.
By default, App Service uses the system-assigned managed identity to resolve Key Vault references if no user-assigned identity is specified.
2
Grant the required permissions on the Key Vault to the identified identity.
Create a Key Vault access policy with the Get secret permission or assign an Azure RBAC role (such as Key Vault Secrets User) to the system-assigned managed identity.
The 'Access Denied' status indicates that the web app's identity successfully reached the Key Vault but lacks authorization to read the secret.

Anahtar Kavram

Azure App Service Key Vault references require both a valid reference syntax and appropriate access policies granted to the app's managed identity.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Configure Azure App Service Web Apps

Bu konudan daha fazla soru