AZ-500 Question 157
Single answerYou have an Azure Web App that needs to read and write data in a specific container within an Azure Blob Storage account. To avoid storing any secrets in application code or configuration, and to ensure that the access is restricted only to this container, which method of granting access should you choose?
- A
Configure the Web App to use a system-assigned managed identity and grant it the Storage Blob Data Contributor role on the container
- B
Store the storage account key in Azure Key Vault and reference it from the Web App's application settings
- C
Use a user delegation SAS with an indefinite expiration date and embed the SAS URL in the Web App code
- D
Enable public read/write access on the container and rely on an IP-based firewall rule for security
Show answer and explanation
Correct answer: A
Explanation
Using a system-assigned managed identity with Azure RBAC is a best practice recommended by Microsoft to avoid secret management and provide least-privileged access (see Azure documentation on 'Authorize access to blobs with Azure Active Directory'). By granting only the necessary role on the specific container, you ensure secure, granular permissions without risking exposure of keys or tokens.
- A. Correct.
Option 1 is correct. A system-assigned managed identity enables the Web App to obtain tokens from Azure AD and securely access the specific container by assigning the Storage Blob Data Contributor role at the container level. This approach avoids storing secrets in code and allows fine-grained permissions.
- B. Incorrect.
Option 2 is incorrect because it still involves managing and storing the storage account key (even though it's in Azure Key Vault). While Key Vault is more secure than embedding secrets in code, this approach does not offer the same granular, identity-based access control as managed identities. If the key is compromised, it provides full access to the entire storage account.
- C. Incorrect.
Option 3 is incorrect because using a user delegation SAS with no expiration date embedded in the code is insecure. SAS tokens should have limited lifetimes to reduce the risk if they are leaked, and storing them in code increases the risk of unauthorized access.
- D. Incorrect.
Option 4 is incorrect because enabling public access can expose the container to the internet. An IP-based firewall rule alone is not sufficient to secure your blob data, as it does not enforce identity-based access or granular permissions.