Examkin

Soru

Zorluk: OrtaSecure App Configuration and Key Vault References

You are deploying a Java Spring Boot application to an Azure App Service (Linux). The application loads its configuration settings from an Azure App Configuration store using the Spring Cloud Azure App Configuration library. The App Configuration store contains a key named `/application/payment-gateway-key` configured as a Key Vault reference that points to a secret in an Azure Key Vault named `kv-payment-prod`. A system-assigned managed identity is enabled on the App Service. When the application starts, it throws an authorization exception while trying to resolve the Key Vault reference.

Which of the following configurations is required to successfully resolve the secret value at runtime?

  1. A
    Update the /application/payment-gateway-key key in the Azure App Configuration store to use the value @Microsoft.KeyVault(SecretUri=https://kv-payment-prod.vault.azure.net/secrets/GatewayKey) and set the content type to application/json.
  2. B
    Grant the App Service's system-assigned managed identity the App Configuration Data Reader role on the Azure App Configuration store, and grant the Azure App Configuration instance the Key Vault Secrets User role on the Azure Key Vault.
  3. Grant the App Service's system-assigned managed identity the App Configuration Data Reader role on the Azure App Configuration store, and grant the same identity the Key Vault Secrets User role on the Azure Key Vault.Cevap
  4. D
    Enable a user-assigned managed identity on the Azure App Configuration store, grant it the Key Vault Administrator role, and associate that user-assigned identity with the App Service.

Cevap

The correct configuration requires granting the App Service's system-assigned managed identity the App Configuration Data Reader role on the App Configuration store and the Key Vault Secrets User role on the Key Vault.
The correct answer is the configuration where the App Service's system-assigned managed identity is granted App Configuration Data Reader on the App Configuration store and Key Vault Secrets User on the Key Vault. The client application provider library loads the Key Vault reference metadata (specifically the URI) from the App Configuration store and then connects directly to the Key Vault to resolve the secret value using its own managed identity. Thus, the App Service identity needs read access to both resources.

Adım Adım Çözüm

1
Enable a system-assigned managed identity on the Azure App Service host.
An identity is created in Microsoft Entra ID representing the App Service instance.
This identity will be used to authenticate requests to both Azure App Configuration and Azure Key Vault.
2
Grant the App Service's managed identity the App Configuration Data Reader role on the App Configuration store.
The application can authenticate and retrieve configuration key-values, including the Key Vault reference metadata.
The application needs access to read configuration keys before it can resolve references.
3
Grant the App Service's managed identity the Key Vault Secrets User role on the Azure Key Vault.
The application can retrieve the secret payload directly from the Key Vault.
Key Vault references are resolved on the client side; the application identity, not the App Configuration store, must have permission to access the secret.

Anahtar Kavram

Azure App Configuration Key Vault Reference Resolution Process
Bu soruyu puanla

Konular

Secure App Configuration and Key Vault References

Bu konudan daha fazla soru