Question
You have an Azure key vault named KV1 that uses role-based access control (RBAC) for data plane authorization.
You have a user named User1 and an Azure App Service web app named App1 that has a system-assigned managed identity.
You need to configure authorization to meet the following requirements:
- App1 must be able to retrieve secrets from KV1.
- User1 must manage the KV1 settings without accessing secret values.
The solution must follow the principle of least privilege.
Which role should you assign to each identity for KV1? To answer, drag the appropriate roles to the correct identities. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Key Vault Contributor is a control plane role for managing key vaults and does not allow access to keys, secrets or certificates, so it fits User1. Key Vault Secrets User can read secret contents and nothing more, which is the least privilege App1 needs. Key Vault Administrator performs all data plane operations and cannot manage the vault resource, so it fails User1's requirement and is excessive for App1. Key Vault Secrets Officer can perform any action on secrets, which exposes secret values to User1 and gives App1 more than it needs.
