Examkin

Soru

Zorluk: OrtaSecure API Management Endpoints

An organization is securing a backend REST API by routing requests through Azure API Management (APIM). The backend API requires an API key in the request header for authorization. You store this API key as a secret in Azure Key Vault.

You need to configure APIM to retrieve this secret from Key Vault using a user-assigned managed identity named `apim-kv-identity`. You have already associated the user-assigned identity with the APIM instance.

Which configuration should you implement to retrieve the secret and pass it to the backend service?

  1. Grant the user-assigned managed identity `apim-kv-identity` GET permissions on Key Vault secrets. In APIM, create a named value referencing the Key Vault secret URI and specify the user-assigned identity. In the <inbound> policy section, use the <set-header> policy to reference the named value.Cevap
  2. B
    Grant the APIM system-assigned managed identity GET permissions on Key Vault secrets. In APIM, create a named value referencing the Key Vault secret URI and specify the system-assigned identity. In the <inbound> policy section, use the <set-header> policy to reference the named value.
  3. C
    Grant the user-assigned managed identity `apim-kv-identity` GET permissions on Key Vault secrets. In APIM, create a named value referencing the Key Vault secret URI and specify the user-assigned identity. In the <outbound> policy section, use the <set-header> policy to reference the named value.
  4. D
    In APIM, create a named value referencing the Key Vault secret URI and specify the user-assigned identity. In the <inbound> policy section, use the <set-header> policy to reference the named value. Do not configure any additional access policies or roles on Key Vault, as associating the identity with APIM automatically grants access.

Cevap

Grant the user-assigned managed identity `apim-kv-identity` GET permissions on Key Vault secrets, configure a named value in APIM referencing the Key Vault secret URI using that user-assigned identity, and use the `<set-header>` policy in the `<inbound>` section to reference the named value.
The correct configuration uses the user-assigned identity to securely fetch the backend API key secret from Key Vault via an APIM named value, and uses the `<set-header>` policy in the inbound section to add the key to the request sent to the backend. This ensures the key is protected in Key Vault and only retrieved when processing requests.

Adım Adım Çözüm

1
Grant Access to Key Vault
The user-assigned managed identity `apim-kv-identity` is granted GET permissions on Key Vault secrets via access policy or Azure RBAC.
Before APIM can fetch any secrets, the identity it uses must be authorized to read secrets from the Key Vault.
2
Create Named Value in APIM
A named value referencing the Key Vault secret URI is created and configured to authenticate using the user-assigned managed identity.
This allows APIM to fetch the secret value securely at runtime using the specified identity.
3
Configure the Inbound Policy
The `<set-header>` policy is added to the `<inbound>` section, referencing the named value to set the backend authorization header.
Injecting the header in the inbound section ensures the API key is included in the request sent to the backend service.

Anahtar Kavram

Securing backend services with Azure API Management using User-Assigned Managed Identity and Key Vault secret references in inbound policies.
Bu soruyu puanla

Konular

Secure API Management Endpoints

Bu konudan daha fazla soru