An organization is migrating an ASP.NET Core web application to Azure App Service. The application must retrieve a database connection string from Azure Key Vault `kv-prod` using Azure App Configuration. The web application is configured to use a user-assigned managed identity named `id-app-prod`. The Azure Key Vault uses Azure role-based access control (Azure RBAC) for authorization. You need to configure the App Configuration key-vault reference and ensure the App Service web application can retrieve the database connection string. Which two configuration steps must you perform? (Select TWO)
- Configure a key-value pair in Azure App Configuration with a value of `@Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn-string)`Cevap
- BConfigure a key-value pair in Azure App Configuration with a value of `@Azure.KeyVault(Uri=https://kv-prod.vault.azure.net/secrets/db-conn-string)`
- Assign the 'Key Vault Secrets User' Azure RBAC role to the user-assigned managed identity `id-app-prod` for the Key Vault `kv-prod`Cevap
- DGrant the Azure App Configuration system-assigned managed identity a Key Vault access policy with 'Get' secret permissions
Cevap
Configure a key-value pair in Azure App Configuration with a value using the `@Microsoft.KeyVault(SecretUri=...)` syntax, and assign the 'Key Vault Secrets User' Azure RBAC role to the user-assigned managed identity `id-app-prod` on the Key Vault.
The correct configuration requires using the exact `@Microsoft.KeyVault(SecretUri=...)` syntax in Azure App Configuration so the client provider knows to retrieve the secret value from Azure Key Vault. In addition, because the Key Vault uses Azure RBAC for authorization, the application's user-assigned managed identity must be granted the 'Key Vault Secrets User' role. The client application resolves these references at runtime using its own credentials, not the App Configuration service principal.
Adım Adım Çözüm
Anahtar Kavram
Azure App Configuration Key Vault References and Azure RBAC Authorization