You are configuring an Azure App Service web app named `app-billing-prod` to retrieve database credentials from an Azure Key Vault named `kv-billing-prod` using a user-assigned managed identity named `id-billing-prod`.
Which two of the following actions must you perform to configure the web app to resolve Key Vault references using the user-assigned managed identity?
- Set the Key Vault reference identity configuration of the web app to the resource ID of `id-billing-prod`.Cevap
- Create a Key Vault access policy in `kv-billing-prod` that grants the Secret Get permission to `id-billing-prod`.Cevap
- CCreate a Key Vault access policy in `kv-billing-prod` that grants the Secret Get permission to the system-assigned managed identity of `app-billing-prod`.
- DInclude the identity's client ID inside the application setting value using the syntax `@Microsoft.KeyVault(SecretUri=https://kv-billing-prod.vault.azure.net/secrets/DbPassword/;Identity=id-billing-prod)`.
Cevap
To configure the web app to resolve Key Vault references using a user-assigned managed identity, you must set the web app's Key Vault reference identity configuration to the resource ID of the user-assigned identity, and create an access policy in the Key Vault that grants the Secret Get permission to the user-assigned managed identity.
To resolve Key Vault references using a user-assigned managed identity, the App Service needs to know which identity to use, and that identity must have read access to the secrets. This is accomplished by setting the Key Vault reference identity configuration of the web app to the user-assigned identity's resource ID, and creating a Key Vault access policy that grants the Secret Get permission to that user-assigned identity.
Adım Adım Çözüm
Anahtar Kavram
Configuring Key Vault references with user-assigned managed identity in Azure App Service