AZ-500 Question 38
Single answerYou are configuring an Azure DevOps pipeline that uses a service principal to deploy new Azure resources into a specific resource group and retrieve secrets from an Azure Key Vault. The service principal should have the minimum privileges needed to perform these tasks, following the principle of least privilege. Which of the following approaches best meets these requirements?
- A
Assign the Contributor role at the subscription scope and the Key Vault Contributor role at the Key Vault scope.
- B
Assign the Contributor role at the resource group scope and the Key Vault Secrets User role at the Key Vault scope.
- C
Assign the Owner role at the resource group scope.
- D
Assign only the Key Vault Secrets User role at the Key Vault scope.
Show answer and explanation
Correct answer: B
Explanation
To adhere to the principle of least privilege, assign the narrowest possible roles for each task. Contributor at the resource group level is sufficient for creating and updating resources within that group and does not affect other resources outside the scope. Key Vault Secrets User at the Key Vault scope restricts the service principal to only reading secrets, which is all that is required from Key Vault. For further guidance, refer to Microsoft documentation on using Azure RBAC for controlling access to Key Vault and other Azure resources.
- A. Incorrect.
Incorrect. Assigning Contributor at the subscription level grants unnecessary privileges over all resources in the subscription, which violates least privilege principles. Key Vault Contributor also grants more access (modify settings) than just reading secrets.
- B. Correct.
Correct. Granting Contributor at the resource group scope provides sufficient permissions to deploy and manage resources in that group, while limiting access to other resources. Assigning Key Vault Secrets User at the Key Vault scope allows reading secrets without permitting modifications to the vault.
- C. Incorrect.
Incorrect. The Owner role provides full permissions, including the ability to grant access to other users, and is broader than needed for typical deployment tasks.
- D. Incorrect.
Incorrect. While the Key Vault Secrets User role allows reading secrets, this alone will not allow the pipeline to create or manage Azure resources in the resource group.