Examkin

Soru

Zorluk: ZorSystem-Assigned and User-Assigned Managed Identities

An enterprise ASP.NET Core application is hosted on an Azure Virtual Machine. The virtual machine has been assigned two user-assigned managed identities: IdentityA (authorized to read secrets from Azure Key Vault) and IdentityB (authorized to write to Azure Storage). To retrieve secrets, the application uses the following C# code:

csharp
var client = new SecretClient(
new Uri("https://myvault.vault.azure.net/"),
new DefaultAzureCredential()
);

When execution occurs on the virtual machine, authentication fails with a CredentialUnavailableException.

Which action must you perform to resolve the authentication failure?

  1. Configure the DefaultAzureCredential to target IdentityA by passing DefaultAzureCredentialOptions with the ManagedIdentityClientId property set to the client ID of IdentityA.Cevap
  2. B
    Enable the system-assigned managed identity on the virtual machine and assign it the same permissions as IdentityA, since DefaultAzureCredential does not support user-assigned managed identities.
  3. C
    Assign the 'Key Vault Secrets User' RBAC role to the virtual machine's resource ID instead of the managed identity, because Key Vault access policies do not support user-assigned identities.
  4. D
    Update the virtual machine's identity block in the Resource Manager template to set the identityType property to systemAssignedUserAssigned to allow automatic resolution.

Cevap

Configure the DefaultAzureCredential to target IdentityA by passing DefaultAzureCredentialOptions with the ManagedIdentityClientId property set to the client ID of IdentityA.
The correct action is to configure the DefaultAzureCredential to target IdentityA by passing DefaultAzureCredentialOptions with the ManagedIdentityClientId property set to the client ID of IdentityA. When multiple user-assigned managed identities are assigned to a single Azure resource, the IMDS endpoint requires the client ID to resolve the ambiguity and issue the correct token.

Adım Adım Çözüm

1
Analyze the exception context and resource configuration.
The virtual machine is configured with multiple user-assigned managed identities (IdentityA and IdentityB) but the application uses DefaultAzureCredential with default options.
When multiple user-assigned managed identities are assigned to a single resource, the Instance Metadata Service (IMDS) endpoint cannot automatically determine which identity to use.
2
Determine the required client-side configuration for the Azure.Identity SDK.
Identify that ManagedIdentityClientId must be set in DefaultAzureCredentialOptions to specify the target user-assigned identity.
Specifying the client ID tells DefaultAzureCredential to pass the client ID parameter to the IMDS token request, resolving the identity ambiguity.
3
Update the client initialization code.
Initialize SecretClient using the configured DefaultAzureCredential.
This allows the application to successfully authenticate and retrieve secrets from the Key Vault using the permissions of IdentityA.

Anahtar Kavram

Handling multiple user-assigned managed identities with DefaultAzureCredential in the Azure SDK
Bu soruyu puanla

Konular

System-Assigned and User-Assigned Managed Identities

Bu konudan daha fazla soru