Examkin

Soru

Zorluk: OrtaRun Containerized Solutions using Azure Container Instances

You are developing a containerized background service that will be deployed to Azure Container Instances (ACI). The service must retrieve messages from an Azure Queue Storage queue, process the data, and write output files to an Azure Blob Storage container. You need to configure security and handle message payloads that may occasionally exceed 64 KB. Which configuration should you implement to meet these requirements securely while ensuring operational reliability?

  1. A
    Generate an Account SAS token with full read, write, and delete permissions valid for two years, configure it as an environment variable in the ACI deployment, and send all message payloads directly to the queue.
  2. B
    Configure a user-assigned managed identity on the ACI container group because system-assigned managed identities cannot be assigned RBAC roles, assign it the Storage Queue Data Reader role, and send all message payloads directly to the queue.
  3. Enable a system-assigned managed identity on the ACI container group, assign it the Storage Queue Data Message Processor and Storage Blob Data Contributor roles, and store payloads larger than 64 KB in Blob Storage while sending only the URI reference in the queue message.Cevap
  4. D
    Enable a system-assigned managed identity on the ACI container group, assign it the Storage Blob Data Contributor role, and send all message payloads directly to the queue.

Cevap

Enable a system-assigned managed identity on the ACI container group, assign it the Storage Queue Data Message Processor and Storage Blob Data Contributor roles, and store payloads larger than 64 KB in Blob Storage while sending only the URI reference in the queue message.
To securely connect the containerized service to Azure storage resources without managing credentials, a system-assigned managed identity should be enabled on the container group. The identity can then be granted the specific Azure RBAC roles required (Storage Queue Data Message Processor for queue operations and Storage Blob Data Contributor for blob operations). Furthermore, because Azure Queue Storage enforces a strict 64 KB size limit per message, payloads exceeding this threshold must be stored in Blob Storage, with only the reference URI placed in the queue.

Adım Adım Çözüm

1
Configure authentication for the container group using a managed identity.
Enable a system-assigned managed identity on the Azure Container Instance (ACI) container group and assign it the necessary RBAC roles (Storage Queue Data Message Processor and Storage Blob Data Contributor) on the target storage resources.
This avoids hardcoding credentials or using long-lived SAS tokens, adhering to the principle of least privilege.
2
Implement message size handling in the application code.
Check if the message payload size exceeds 64 KB. If it does, upload the payload to Blob Storage first, and then write a queue message containing the URI reference to the blob.
Azure Queue Storage has a strict 64 KB message size limit, so larger payloads must be stored externally in Blob Storage.

Anahtar Kavram

Securing Azure Container Instances using managed identities and handling Queue Storage limits for large payloads.
Bu soruyu puanla

Konular

Run Containerized Solutions using Azure Container Instances

Bu konudan daha fazla soru