Examkin

Soru

Zorluk: ZorCreate and Configure Azure Functions

You are developing a secure serverless solution using Azure Functions V4. You need to configure a Function App to retrieve a database connection string from an Azure Key Vault. The security team requires that you use a user-assigned managed identity rather than a system-assigned managed identity to access the Key Vault secrets.

Which five actions should you perform in sequence to configure the Function App? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Create a user-assigned managed identity in Microsoft Entra ID.
  2. 2Associate the user-assigned managed identity with the Azure Function App.
  3. 3Create an access policy or RBAC role assignment in the Azure Key Vault that grants Secret Get permission to the user-assigned managed identity.
  4. 4Configure the key vault reference identity of the Function App to use the resource ID of the user-assigned managed identity.
  5. 5Create a new application setting in the Function App that references the Key Vault secret using the @Microsoft.KeyVault syntax.

Cevap

To configure the Function App to use a user-assigned managed identity for Key Vault references, you must first create a user-assigned managed identity in Microsoft Entra ID. Next, associate the user-assigned managed identity with the Function App. Then, create an access policy or RBAC role assignment in Key Vault granting the identity Secret Get permissions. After that, set the keyVaultReferenceIdentity configuration of the Function App to the resource ID of the user-assigned identity. Finally, create a new application setting in the Function App using the @Microsoft.KeyVault reference syntax.
The correct sequence of steps requires first creating the user-assigned managed identity and associating it with the Function App. Then, the identity must be granted Secret Get permissions in the Key Vault. To ensure that Key Vault references resolve using this user-assigned identity instead of the default system-assigned identity, the Function App's configuration must be updated to specify the user-assigned identity as the key vault reference identity. Finally, the application setting is created using the Key Vault reference syntax, which allows the Function App to load the database connection string securely.

Adım Adım Çözüm

1
Create a user-assigned managed identity.
A managed identity resource is created in Microsoft Entra ID with a client ID and principal ID.
The identity is needed as the security principal that will be assigned permissions and associated with the Function App.
2
Associate the identity with the Function App.
The Function App is updated to include the user-assigned managed identity.
This allows the Function App to authenticate using this specific identity.
3
Configure Key Vault access permissions.
An access policy or Azure RBAC role assignment is created in the Key Vault allowing the user-assigned identity's principal to perform Get operations on secrets.
The identity must have permission to read the secret; otherwise, Key Vault reference resolution will fail.
4
Set the Key Vault reference identity for the Function App.
The Function App's configuration is updated with keyVaultReferenceIdentity set to the resource ID of the user-assigned managed identity.
By default, Azure Functions attempts to resolve Key Vault references using the system-assigned identity. To use a user-assigned identity, you must explicitly configure this setting.
5
Create the application setting with Key Vault reference syntax.
The application setting is added to the Function App using the format @Microsoft.KeyVault(SecretUri=...).
This triggers the Azure Functions host to automatically fetch the secret from Key Vault and inject it into the app environment settings.

Anahtar Kavram

Configuring Azure Functions to retrieve Key Vault secrets using a User-Assigned Managed Identity
Bu soruyu puanla

Konular

Create and Configure Azure Functions

Bu konudan daha fazla soru