A fintech runs a Kubernetes scoring service and a serverless function, and both call the same Azure AI resource. The security team wants each workload to have distinct, auditable permissions with no shared credentials. Which approach fits?
Show answer and explanation
Answer: C
Managed identities give each workload its own Microsoft Entra identity, and RBAC roles scoped to the AI resource grant only the operations that workload needs. Because each identity appears separately in audit logs, the security team can trace which workload made which call and revoke one without affecting the others. No secret has to be copied between services, so there is nothing to leak.
Why the other options are wrong
- A. A key in a Kubernetes secret is still a shared credential. Anyone who can read it can call the resource, and the key cannot be attributed to one workload.
- B. Opening network access to all addresses widens the attack surface. Reviewing logs afterward is detective, not preventive, and does not enforce least privilege.
- D. Pipeline variables expose the key to anyone with pipeline access and spread a shared credential across environments. Rotating it would disrupt every consumer at once.