Examkin

Soru

Zorluk: OrtaCreate and Configure Azure Functions

A development team is configuring an Azure Function App (V4 runtime) to connect to a SQL database. The database connection string must be stored securely in Azure Key Vault. The security architecture mandates that the Function App must retrieve the connection string at runtime using a system-assigned managed identity, without storing any credentials in the application's configuration settings.

Which of the following configuration flows must be implemented to ensure the Function App can successfully retrieve the connection string?

  1. A
    Enable the system-assigned managed identity on the Function App, set the application setting value to @Microsoft.KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/<secret-name>/), and do not assign Key Vault roles as system-assigned identities automatically inherit read permissions within the same resource group.
  2. Enable the system-assigned managed identity on the Function App, grant this identity the Key Vault Secrets User role on the Key Vault, and set the application setting value to @Microsoft.KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/<secret-name>/).Cevap
  3. C
    Enable the system-assigned managed identity on the Function App, grant this identity the Key Vault Secrets User role on the Key Vault, and set the application setting value to @KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/<secret-name>/).
  4. D
    Enable a user-assigned managed identity on the Function App, grant this identity the Key Vault Secrets User role on the Key Vault, set the application setting value to @Microsoft.KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/<secret-name>/), and omit further configurations as App Service resolves user-assigned identities automatically.

Cevap

Enable the system-assigned managed identity on the Function App, grant this identity the Key Vault Secrets User role on the Key Vault, and set the application setting value to @Microsoft.KeyVault(SecretUri=https://<vault-name>.vault.azure.net/secrets/<secret-name>/).
To securely fetch secrets from Azure Key Vault without storing credentials, you must enable the system-assigned managed identity on the Function App and authorize it in the Key Vault by granting the Key Vault Secrets User role. Additionally, the Key Vault reference in the Application Settings must conform to the strict '@Microsoft.KeyVault(SecretUri=...)' syntax.

Adım Adım Çözüm

1
Enable the system-assigned managed identity on the Azure Function App.
The Function App gets registered in Microsoft Entra ID with a unique principal ID.
This identity represents the Function App instance and is used to authenticate to other Azure services without credentials.
2
Assign the 'Key Vault Secrets User' role (or configure a Key Vault Access Policy with GET permissions) for the Function App's system-assigned identity on the target Key Vault.
The Function App is authorized to read secrets from the Key Vault.
Managed identities do not have access to Key Vault secrets by default; least-privilege access must be explicitly granted.
3
Add a new Application Setting in the Function App configuration with the connection string key, setting the value to the Key Vault reference format @Microsoft.KeyVault(SecretUri=...).
The Functions runtime automatically resolves the setting to the secret's value at application startup.
This syntax tells the App Service/Functions infrastructure to retrieve the secret value from Key Vault using the app's identity and inject it as an environment variable.

Anahtar Kavram

Configuring Key Vault references with Managed Identities in Azure Functions
Bu soruyu puanla

Konular

Create and Configure Azure Functions

Bu konudan daha fazla soru