Question

Your team runs a containerized application on Azure Kubernetes Service (AKS) that must read connection strings from Azure Key Vault. You have enabled workload identity on the cluster and assigned a user-assigned managed identity to the workload. Security policy requires that permissions be auditable through Azure role assignments and that individual secret access be granted with the narrowest possible scope. The Key Vault currently uses the vault access policy permission model. What should you do to meet the requirements with the least ongoing administrative effort?

Accepted Answer

Switch the Key Vault to the Azure RBAC permission model and grant the managed identity the Key Vault Secrets User role scoped to the specific secret.

Answer

Keep the vault access policy model and add an access policy granting the managed identity Get and List permissions on secrets.

Answer

Switch the Key Vault to the Azure RBAC permission model and grant the managed identity the Key Vault Administrator role scoped to the vault.

Answer

Keep the vault access policy model and store the managed identity's client secret in a pipeline variable group to authenticate to the vault.