Key Vault RBAC Rules

This page describes how to allow RADNAC to access the certificates you store in a Key Vault.

Be aware of Azure RBAC propagation delays.

The recommended and simpliest option is to assign the Key Vault Certificate User role on the entire Key Vault.

The identity you will need to assign it to is the System Assigned managed identity associated with the managed application resource.

If you prefer per-certificate permissions in a given Key Vault, look to the Single Certificate section below.

Preflight (Checklist)

Steps

To do this:

  1. Go to the managed application.

  2. Navigate the sidebar menu on the left through Settings  Identity.

  3. Make sure the ‘System assigned’ tab is selected in the main panel.

  4. Under ‘Permissions’, click on the Azure role assignments button.

  5. In the new panel, listed will show all the resources that RADNAC may access.

  6. Click on the Add role assignment button found to the top of the panel.

  7. In the new sidebar panel that opened to the right, set the following options to:

    Scope

    Key Vault

    Subscription

    Select the subscription where your Key Vault is located.

    Resource

    Select your Key Vault.

    Role

    Key Vault Certificate User

  8. Click on the Save button found at the bottom.

Single Certificate

This process describes how to apply RBAC rules to limit RADNAC’s access to a single certificate in a Key Vault.

It is not possible to do this from the web based Azure Portal, and you will need to use the command line to do this.

Obtain the Object (principal) ID of RADNAC’s managed application’s identity, either by:

Azure’s web based Portal

  1. Open the managed application.

  2. Navigate the left side bar Settings  Identity.

  3. Make a note of the GUID listed for ‘Object (principal) ID’.

Azure CLI tools

Run the following substituting the placeholders with the values that represent RADNAC’s Managed Application resource:

az managedapp show \
	--id /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Solutions/applications/{name} \
	--query identity.principalId \
	--output tsv

Set the variable OID to the output value of this command for use in the following commands.

Now from a terminal run:

az role assignment create \
	--role 'Key Vault Certificate User' \
	--scope /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{keyVaultName}/certificates/{name} \
	--assignee-principal-type ServicePrincipal \
	--assignee-object-id $OID

az role assignment create \
	--role 'Key Vault Certificate User' \
	--scope /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{keyVaultName}/secrets/{name} \
	--assignee-principal-type ServicePrincipal \
	--assignee-object-id $OID