Examkin

Soru

Zorluk: OrtaAzure Key Vault Secret, Key, and Certificate Management

A developer deploys a C# API to an Azure App Service named api-prod. The API retrieves its database password from an Azure Key Vault named kv-prod. The Key Vault's permission model is configured to use Azure role-based access control (Azure RBAC).

To configure the App Service, the developer creates an application setting named DbPassword with the following value:
@Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbPassword)

After enabling the system-assigned managed identity on api-prod, the developer observes that the API receives a 403 Forbidden error when trying to retrieve the secret.

Which of the following actions should you perform to resolve the secret retrieval failure?

  1. A
    Create a Key Vault access policy in kv-prod that grants the Secret Get permission to the api-prod system-assigned managed identity.
  2. Assign the Key Vault Secrets User role to the api-prod system-assigned managed identity at the key vault or secret scope.Cevap
  3. C
    Change the value of the DbPassword application setting in api-prod to @KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/DbPassword).
  4. D
    Create a user-assigned managed identity, assign it the Key Vault Secrets User role, and configure it as the identity of the kv-prod Key Vault itself.

Cevap

Assign the Key Vault Secrets User role to the api-prod system-assigned managed identity at the key vault or secret scope.
Since the Key Vault is configured to use the Azure RBAC permission model, you must use Azure role assignments to authorize access. Assigning the Key Vault Secrets User role to the App Service's system-assigned managed identity allows the application to read the secret value while maintaining least privilege.

Adım Adım Çözüm

1
Identify the authorization model configured on the Azure Key Vault.
The Key Vault is configured to use the Azure role-based access control (Azure RBAC) permission model instead of access policies.
This determines how permissions must be granted to the client application.
2
Determine the correct identity to which permissions must be assigned.
The App Service api-prod has a system-assigned managed identity enabled, which must be granted access.
The client application uses its managed identity to authenticate against the Key Vault.
3
Select the appropriate Azure RBAC role and scope for least privilege secret retrieval.
Assign the Key Vault Secrets User role to the managed identity of the App Service at the key vault or individual secret scope.
Key Vault Secrets User is the built-in role that allows reading secret values, satisfying the least privilege requirement.

Anahtar Kavram

Azure Key Vault authorization using Azure RBAC vs Access Policies for App Service managed identities
Bu soruyu puanla

Konular

Azure Key Vault Secret, Key, and Certificate Management

Bu konudan daha fazla soru