You are securing an API hosted in Azure API Management (APIM). The security requirements specify that clients must authenticate using client certificates. The allowed certificate thumbprint is stored as a secret in Azure Key Vault.
You configure a system-assigned managed identity for the APIM instance.
You create a Named Value in APIM named `CertThumbprint` that references the Key Vault secret. You then add an inbound policy to validate the client certificate thumbprint against the `CertThumbprint` named value.
During testing, requests fail with an HTTP 500 Internal Server Error. The diagnostic logs indicate that APIM is unauthorized to retrieve the secret value from Key Vault.
Which of the following actions will resolve this issue?
- Grant the APIM system-assigned managed identity the 'Get' permission for secrets in the Azure Key Vault access policy.Cevap
- BConfigure the APIM instance to use a user-assigned managed identity, as system-assigned managed identities are not supported for Key Vault-backed Named Values.
- CGrant the APIM system-assigned managed identity the 'Get' permission for certificates in the Azure Key Vault access policy, leaving secrets permissions unconfigured.
- DAdd a client credential client secret to the APIM instance configuration and assign it access to the Key Vault secrets.
Cevap
Grant the APIM system-assigned managed identity the 'Get' permission for secrets in the Azure Key Vault access policy.
To resolve the authorization issue, the system-assigned managed identity of the APIM instance must be granted the 'Get' permission for secrets in the Azure Key Vault access policy. This allows the APIM gateway to dynamically retrieve the secret value containing the certificate thumbprint when executing the policy.
Adım Adım Çözüm
Anahtar Kavram
Securing APIM endpoints with client certificate validation backed by Azure Key Vault secrets retrieved using managed identities.