Examkin

Soru

Zorluk: OrtaCreate and Configure Azure Functions

You are deploying an Azure Function App (V4 runtime) that needs to securely access an Azure SQL Database. The database connection string contains sensitive credentials and is stored in Azure Key Vault. You have enabled a system-assigned managed identity for the Function App.

You want to configure the Function App settings to reference the connection string from Key Vault without storing it as cleartext in the app configuration. However, when the Function runs, it fails to connect to the database and logs an authorization error indicating it cannot retrieve the secret from Key Vault.

You inspect the application setting value and find that it is:
`@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/dbconn/f4a5b6)`

Which of the following is the most likely cause of this issue?

  1. A
    The Key Vault reference syntax is invalid because the @Microsoft. prefix should be omitted, and it should start directly with @KeyVault.
  2. B
    The Function App must use a user-assigned managed identity rather than a system-assigned managed identity to resolve Key Vault references.
  3. The system-assigned managed identity of the Function App has not been granted GET permissions on the Key Vault secrets.Cevap
  4. D
    The Function App is hosted on a Consumption plan, which does not support the resolution of Key Vault references.

Cevap

The system-assigned managed identity of the Function App has not been granted GET permissions on the Key Vault secrets.
For Key Vault references to resolve correctly at runtime, the managed identity assigned to the Function App must be granted GET permission on secrets in the Key Vault. If this access is missing, the reference resolution fails, leading to authorization errors.

Adım Adım Çözüm

1
Verify that the Key Vault reference syntax in the Function App settings is correct.
The reference syntax `@Microsoft.KeyVault(SecretUri=...)` is correct and follows the required formatting rules.
An incorrect syntax would result in the setting being treated as cleartext rather than a reference, or failing to parse.
2
Check the permissions assigned to the Function App's system-assigned managed identity on the Key Vault.
The system-assigned managed identity exists but lacks 'Get' secret permissions under Key Vault Access Policies or Azure RBAC.
Azure Functions uses the managed identity to authenticate and retrieve the secret at runtime, which requires explicit authorization.
3
Configure the Key Vault access policy or Azure RBAC role assignment.
Assign the 'Key Vault Secrets User' RBAC role or add an Access Policy granting 'Get' permissions to the system-assigned managed identity.
This establishes the necessary permission chain allowing the Function App host to resolve the secret reference successfully.

Anahtar Kavram

Azure Functions Key Vault References and Managed Identities
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Create and Configure Azure Functions

Bu konudan daha fazla soru