Examkin

Soru

Zorluk: OrtaCreate and Configure Azure Functions

An organization is deploying an Azure Function App (V4 runtime) that requires access to a database password. To secure the credential, the password is stored in an Azure Key Vault. A developer configures an App Setting in the Function App named DatabaseConnectionString with the value @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/dbpassword/). When the function executes, it is unable to connect to the database because the environment variable retrieves the raw @Microsoft.KeyVault(...) reference string instead of the resolved secret value. Which of the following is the most likely cause of this behavior?

  1. A
    The Key Vault reference syntax is invalid because the secret version must be explicitly appended to the end of the secret URI.
  2. The system-assigned managed identity of the Function App has not been granted GET permissions on secrets in the Key Vault access policies or Azure role-based access control.Cevap
  3. C
    The Function App is running on the serverless Consumption hosting tier, which does not support Key Vault reference resolution.
  4. D
    Key Vault references only support user-assigned managed identities, but the Function App has been configured with a system-assigned managed identity.

Cevap

The system-assigned managed identity of the Function App has not been granted GET permissions on secrets in the Key Vault access policies or Azure role-based access control.
The App Service and Azure Functions runtime resolves Key Vault references at startup or configuration reload using the app's managed identity. If the system-assigned managed identity of the Function App does not have GET permission on secrets in the Key Vault, the platform fails to retrieve the secret and defaults to exposing the raw configuration string to the application code.

Adım Adım Çözüm

1
Identify the mechanism used by the Azure Functions host to resolve Key Vault references.
The Azure Functions platform uses the app's configured managed identity to authenticate and retrieve the secrets from Key Vault.
To troubleshoot the failure of resolving Key Vault references, we must check the authentication and authorization flow between the Function App and the Key Vault.
2
Verify the access control settings on the Key Vault.
The managed identity must be granted GET permission for secrets in either the Key Vault Access Policies or through Azure RBAC (using Key Vault Secrets User role).
Without explicit GET permission, the platform's requests to retrieve the secrets will be denied, causing the runtime to fall back to the raw reference string.
3
Evaluate and eliminate incorrect configuration and hosting constraints.
Omit version constraints are allowed (automatically resolves to latest), both system-assigned and user-assigned identities are supported, and all hosting plans support Key Vault references.
This confirms that the absence of permissions is the only plausible issue causing the raw string to be returned.

Anahtar Kavram

Key Vault references in Azure Functions allow app settings to securely reference secrets stored in Key Vault, requiring appropriate managed identity configurations and access policies.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Create and Configure Azure Functions

Bu konudan daha fazla soru