Question

An enterprise runs microservices across AWS and Azure. A new payment-processing service in AWS must call an inventory API hosted in Azure. The security architect wants the AWS service to authenticate to Azure without any long-lived secrets, static API keys, or shared certificates stored in the workload's configuration. Which approach best satisfies this requirement?

Accepted Answer

Configure Microsoft Entra ID workload identity federation to trust the AWS service's OIDC-issued identity token, exchanging it for a short-lived Azure access token at runtime

Answer

Provision a long-lived Azure service principal client secret, store it in AWS Secrets Manager, and rotate it every 30 days via automation

Answer

Generate a mutual TLS client certificate for the AWS service, embed it in the container image, and register the certificate thumbprint in Microsoft Entra ID

Answer

Create an Microsoft Entra ID user account for the service with a strong password stored in an environment variable and enforce MFA on the account