An organization is implementing a Zero Trust architecture for their AI platform on Azure. An application uses a chain of AI services where each service calls the next. The security team needs to ensure each service-to-service hop is authenticated. What is the correct approach?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you should configure each service with a managed identity and grant the caller's managed identity the minimum required RBAC role on each target service. That verifies each service-to-service hop explicitly without carrying secrets around.
Full Explanation
The correct approach is to configure each service with a managed identity and grant the caller's managed identity the appropriate RBAC role on each target service. This implements the Zero Trust principle of 'verify explicitly' for service-to-service communication by giving each hop a cryptographically verifiable identity and applying least-privilege authorization through Azure RBAC, without introducing shared secrets or secrets-management overhead. Using API keys at each service boundary passed in request headers is incorrect because API keys are shared secrets that cannot be attributed to a specific calling identity and violate Zero Trust principles. Deploying Azure API Management to broker all requests and using a single shared secret for all internal service calls is incorrect because a shared secret used across all services does not provide identity verification and creates a single point of credential compromise. Configuring mutual TLS between all services using certificates stored in Azure Key Vault is incorrect because mutual TLS provides transport-layer authentication but does not provide application-layer identity claims or integrate with Azure RBAC for fine-grained authorization.