Examkin

Soru

Zorluk: OrtaConfigure Azure App Service Web Apps

A development team is deploying a web application to Azure App Service named webapp-orders-prod. The application requires a connection string to a database. The connection string is stored in an Azure Key Vault named kv-orders-prod as a secret named DbConnectionString.

A system-assigned managed identity has been enabled for webapp-orders-prod.

The developer configures an application setting named ConnectionStrings:DefaultConnection on the web app with the value:
@Microsoft.KeyVault(SecretUri=https://kv-orders-prod.vault.azure.net/secrets/DbConnectionString)

However, when the application starts, it fails to connect to the database. Upon checking the Azure portal, the Key Vault reference for ConnectionStrings:DefaultConnection shows a status of 'Access Denied'.

Which configuration step must be performed to resolve this issue?

  1. Grant the system-assigned managed identity of the web app the 'Get' secret permission in the Key Vault's access policies or Azure role-based access control (RBAC).Cevap
  2. B
    Configure a user-assigned managed identity for the web app, as system-assigned managed identities are not supported for Key Vault references.
  3. C
    Change the application setting value prefix to @Microsoft.Azure.KeyVault instead of @Microsoft.KeyVault.
  4. D
    Configure an autoscale rule where the scale-in threshold is set higher than the scale-out threshold to prevent throttling from the Key Vault.

Cevap

Grant the system-assigned managed identity of the web app the 'Get' secret permission in the Key Vault's access policies or Azure role-based access control (RBAC).
The correct answer is to grant the system-assigned managed identity 'Get' permission. For an App Service web app to resolve Key Vault references, it needs read permissions to the Key Vault. Enabling the system-assigned managed identity creates an identity for the web app in Microsoft Entra ID, but you must explicitly authorize it in the Key Vault access policies or via Azure RBAC.

Adım Adım Çözüm

1
Identify the security principal used by the web app.
The web app is configured with a system-assigned managed identity.
App Service uses this identity to authenticate to Key Vault.
2
Configure authorization on the target Azure Key Vault.
Add an access policy or an Azure RBAC role (such as Key Vault Secrets User) for the system-assigned managed identity.
By default, enabling a managed identity does not grant access to data inside Key Vault. The identity must be explicitly authorized to get secrets.

Anahtar Kavram

Configuring Key Vault references in Azure App Service web apps requires both enabling a managed identity on the web app and granting that identity permission to read secrets from the Key Vault.
Bu soruyu puanla

Konular

Configure Azure App Service Web Apps

Bu konudan daha fazla soru