Examkin

Soru

Zorluk: OrtaSystem-Assigned and User-Assigned Managed Identities

You are developing a C# web application that runs on an Azure App Service. The application must retrieve database connection secrets from an Azure Key Vault. You have already enabled a system-assigned managed identity for the App Service.

You write the following code to access the Key Vault:

csharp
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

// ...
var client = new SecretClient(new Uri("https://myvault.vault.azure.net/"), new DefaultAzureCredential());
var secret = await client.GetSecretAsync("DbConnectionString");

When you deploy and run the application in Azure, it fails to retrieve the secret and throws an exception indicating that access is forbidden.

Which of the following actions should you perform to resolve this error?

  1. A
    Modify the C# code to pass the application client ID as a parameter to the constructor of DefaultAzureCredential.
  2. B
    Create an App Registration in Microsoft Entra ID, grant it Key Vault permissions, and assign its credentials to the App Service application settings.
  3. Create an access policy in Azure Key Vault that grants the Get secret permission to the system-assigned managed identity of the App Service.Cevap
  4. D
    Create an access policy in Azure Key Vault that grants the Get secret permission to the App Service's App Registration service principal instead of the system-assigned managed identity.

Cevap

Create an access policy in Azure Key Vault that grants the Get secret permission to the system-assigned managed identity of the App Service.
The correct answer is to create an access policy in Azure Key Vault that grants the Get secret permission to the system-assigned managed identity of the App Service. When the system-assigned managed identity is enabled, Azure automatically creates an enterprise application principal representing the App Service instance. DefaultAzureCredential automatically detects this identity when deployed to Azure and uses it to acquire tokens. However, the identity must be authorized to perform data plane operations on the Key Vault by defining an access policy or an RBAC role assignment.

Adım Adım Çözüm

1
Analyze the error context
The application successfully attempts to authenticate using the system-assigned managed identity, but receives a forbidden response.
This indicates that authentication succeeded, but authorization to access the Key Vault secrets is missing.
2
Configure the Key Vault access policy
Create a new Key Vault access policy matching the system-assigned managed identity's object principal ID, assigning the 'Get' permission under Secret Permissions.
The system-assigned managed identity is a service principal in Microsoft Entra ID and must be granted explicit permissions on the Key Vault data plane.
3
Verify DefaultAzureCredential behavior
No code changes are required because DefaultAzureCredential automatically searches for and utilizes the system-assigned managed identity in the App Service environment.
Ensuring code changes are minimized simplifies deployment and maintenance.

Anahtar Kavram

Azure Managed Identities and Azure Key Vault Authorization
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

System-Assigned and User-Assigned Managed Identities

Bu konudan daha fazla soru