The lock-lab app managed identity only needs to read one secret from Key Vault. Which assignment follows least privilege?
Select an answer to reveal the explanation.
Short Explanation
The app just needs to read a secret—hand it Key Vault Secrets User, not the Contributor badge that rewires the vault. Keep management keys away from the workload identity.
Full Explanation
Key Vault Secrets User is a data-plane role intended for reading secret contents without managing vault configuration. Key Vault Contributor is a control-plane oriented role that can manage vault settings, networking, and related configuration and is excessive for a read-only app identity. Owner and User Access Administrator further expand blast radius beyond secret read. Scope the data-plane role at the vault or individual secret as needed.