An app's managed identity must read secret values from a Key Vault that uses Azure RBAC. Which role follows least privilege?
- A Key Vault Secrets User (correct answer)
- B Key Vault Reader
- C Key Vault Contributor
- D Key Vault Secrets Officer
Shortcut: Read secret values = Key Vault Secrets User. Reader = metadata only. Key Vault Reader sees metadata but not values, Key Vault Contributor manages the vault resource but not its data, and Key Vault Secrets Officer can also create and delete secrets.
Key Vault Secrets User can read secret contents, which is all the app needs. Key Vault Reader sees metadata but not values, Key Vault Contributor manages the vault resource but not its data, and Key Vault Secrets Officer can also create and delete secrets.