Examkin

Soru

Zorluk: Çok zorSecure API Management Endpoints

You are configuring mutual TLS (mTLS) authentication between an Azure API Management (APIM) gateway and a backend API hosted on an Azure App Service. The client certificate used for authentication must be securely stored in Azure Key Vault and dynamically retrieved by APIM. You have already enabled a system-assigned managed identity for the APIM instance.

Which two configurations are required to ensure the APIM gateway successfully retrieves the certificate and authenticates with the backend API? (Select two.)

  1. Grant the API Management system-assigned managed identity Key Vault Secret User (or GET secret) permissions on the Azure Key Vault.Cevap
  2. Add the `<authentication-certificate certificate-id="my-cert" />` policy inside the `<inbound>` element of the API policy configuration.Cevap
  3. C
    Add the `<authentication-certificate certificate-id="my-cert" />` policy inside the `<outbound>` element of the API policy configuration.
  4. D
    Grant the backend App Service's system-assigned managed identity GET certificate permissions on the Azure Key Vault.
  5. E
    Add the `<authentication-certificate certificate-id="my-cert" />` policy inside the `<on-error>` element of the API policy configuration.

Cevap

Grant the API Management system-assigned managed identity Key Vault Secret User (or GET secret) permissions on the Azure Key Vault, and add the `<authentication-certificate certificate-id="my-cert" />` policy inside the `<inbound>` element of the API policy configuration.
To secure the backend connection using mutual TLS (mTLS) with a certificate stored in Azure Key Vault, two main configurations are required: first, the API Management instance must have access to retrieve the certificate's private key from Key Vault, which requires granting its system-assigned managed identity Secret User or Secret GET permissions (as the private key is stored as a secret). Second, the `<authentication-certificate>` policy must be applied in the `<inbound>` policy block to attach the certificate to the outgoing backend request during the TLS handshake.

Adım Adım Çözüm

1
Assign permissions in Azure Key Vault for API Management.
The API Management instance is authorized to retrieve the secret/private key part of the certificate.
Since certificates with private keys are stored as secrets in Azure Key Vault, the API Management managed identity requires Key Vault Secret User or Secret GET permissions to pull the certificate.
2
Add the certificate reference to the API Management instance.
The certificate is registered in the API Management instance with a specific identifier.
Before the certificate can be referenced in policies, it must be added to the certificates repository of the APIM instance by pointing to the Azure Key Vault secret identifier.
3
Configure the API inbound policy to use the certificate.
The request sent to the backend includes the designated client certificate.
The `<authentication-certificate>` policy is evaluated during inbound processing to configure the client certificate for the backend connection.

Anahtar Kavram

Configuring mutual TLS authentication between Azure API Management and backend services using Key Vault integration and inbound policies.
Bu soruyu puanla

Konular

Secure API Management Endpoints

Bu konudan daha fazla soru