Examkin

Soru

Zorluk: ZorSystem-Assigned and User-Assigned Managed Identities

You are transitioning a .NET web application hosted on an Azure App Service named `web-prod` from using a system-assigned managed identity to a new user-assigned managed identity named `id-prod`. The application retrieves secrets from an Azure Key Vault named `kv-prod` using the `DefaultAzureCredential` class. The system-assigned identity must remain temporarily enabled during the migration to prevent configuration issues, but the application must immediately begin using the new user-assigned identity to authenticate. You need to configure the resource association and access permissions using the Azure CLI, and update the application configuration. Arrange the steps in the correct order to achieve this transition while preventing application authorization errors during the configuration process.

  1. 1Run the `az identity create` command to create the user-assigned managed identity `id-prod`.
  2. 2Run the `az webapp identity assign` command to associate the `id-prod` identity with the `web-prod` App Service.
  3. 3Run the `az role assignment create` command to assign the 'Key Vault Secrets User' role to the principal ID of `id-prod` at the Key Vault scope.
  4. 4Add an App Setting to the App Service named `AZURE_CLIENT_ID` containing the client ID of the `id-prod` identity.
  5. 5Deploy the application code that instantiates `DefaultAzureCredential` and uses it to retrieve secrets from the Key Vault.

Cevap

The correct order of steps is: 1) Run `az identity create` to create the user-assigned identity, 2) Run `az webapp identity assign` to associate the identity with the App Service, 3) Run `az role assignment create` to grant the identity the Key Vault Secrets User role, 4) Add the `AZURE_CLIENT_ID` App Setting to direct `DefaultAzureCredential` to the new identity, and 5) Deploy the updated application code.
The correct sequence begins with creating the user-assigned managed identity to obtain its unique identifiers. Next, the identity must be associated with the App Service so that the App Service can request tokens for it. The RBAC role assignment is then configured at the Key Vault scope to authorize access. Following that, the `AZURE_CLIENT_ID` App Setting is configured to instruct `DefaultAzureCredential` to use this specific user-assigned identity, resolving the ambiguity of coexisting identities. Finally, deploying the application code ensures a seamless transition without access failures.

Adım Adım Çözüm

1
Create the user-assigned managed identity.
The identity `id-prod` is created in Microsoft Entra ID, generating its Client ID and Principal ID.
The Client ID and Principal ID are required dependencies for role assignment and App Service configuration.
2
Associate the identity with the App Service host.
The App Service is configured to recognize the user-assigned identity `id-prod`.
The App Service environment must have the identity registered so the Azure Instance Metadata Service (IMDS) token endpoint can retrieve tokens for it.
3
Assign the RBAC role to the identity's Principal ID.
The identity `id-prod` is granted the 'Key Vault Secrets User' role at the `kv-prod` Key Vault scope.
Assigning permissions prior to forcing the application to use the identity prevents 403 Forbidden errors when the application attempts to fetch secrets.
4
Configure the `AZURE_CLIENT_ID` App Setting.
The environment variable `AZURE_CLIENT_ID` is set to the client ID of `id-prod`.
When both system-assigned and user-assigned identities are active on the same App Service, `DefaultAzureCredential` requires the `AZURE_CLIENT_ID` environment variable to identify which user-assigned identity to use.
5
Deploy the application code.
The application runs, and `DefaultAzureCredential` successfully fetches Key Vault secrets using the user-assigned managed identity.
With all infrastructure, permissions, and environment variables fully configured, the application can securely execute without service disruption.

Anahtar Kavram

Configuring coexisting managed identities and directing DefaultAzureCredential using environment variables.
Bu soruyu puanla

Konular

System-Assigned and User-Assigned Managed Identities

Bu konudan daha fazla soru