Only the permits API identity should read the Cosmos key secret in Key Vault. What control enforces that?
Select an answer to reveal the explanation.
Short Explanation
RBAC is the permits desk badge reader—only that API’s identity gets the Cosmos key drawer, not the whole city hall.
Full Explanation
When only the permits API should read the Cosmos key secret, enforce that with Azure Key Vault RBAC (or access policies in legacy vaults) scoped so the permits API managed identity has secret-read rights—typically Key Vault Secrets User—on that vault or secret scope, and other municipal identities do not. Least privilege means the identity that needs the Cosmos connection string can Get/List as required, while parks bots, 311 front ends, and human operators use different roles or none at all. RBAC on Key Vault integrates with Microsoft Entra ID, produces auditable role assignments, and keeps the secret URI usable only for authorized callers.
Granting every municipal subscription Contributor so anyone can list all Key Vault secrets fails least privilege at the widest level: Contributor is a control-plane hammer that far exceeds secret read and exposes every vault operation citywide. Disabling authentication on the Key Vault and relying on an undocumented URI fails the authentication model entirely—obscurity is not authorization, and any caller who learns the URI can retrieve the Cosmos key. Sharing one citywide admin account that every AI workload uses to pull every secret fails accountability and blast-radius control: there is no per-workload identity, rotation hurts every service at once, and forensics cannot tell which app misused the credential.
Exam caveat: distinguish data-plane secret permissions from control-plane roles. Key Vault Secrets User allows secret retrieval; Key Vault Administrator or broad Owner/Contributor assignments are the wrong tool for an application identity. Also confirm whether the vault uses RBAC permission model versus access policies—mixing assumptions is a common exam and field mistake.
Operational check: attempt Get with the permits API identity (should succeed) and with a neighboring service identity (should fail 403); review Key Vault diagnostic logs for the correct caller object id; ensure no standing Contributor assignments exist solely to ‘make secrets work.’