Question 104328 in Azure Question posted in
The official documentation to get you started can be found here.

Can I configure a Azure's key vault secret per service principal?

I’m used to use GCP’s secret manager. There, we can create a secret and give a specific READ permission for one specific service account.
I mean, let’s say we create a secret ABC and a service account "getsecretaccount", I can give the read permission for this SA called getsecretaccount to access the ABC secret. This getsecretaccount will not have access to any other secret there.

Can I achieve this scenario in Azure Key Vault?

Thx!!

Tags:

2

Answers


  1. 0

    if you have 1 azure vault with multiple secrets and you create an access policy for a user and select permission like "get" and/or "list", that user will be able to see all secrets under that vault. no option for separated permission per individual secret

    enter image description here

    enter image description here

    Login or Signup to reply.
  2. 0

    Authorization

    Key vault offer two different Authorizations: older Vault access policy and newer Azure role-based access control

    access control method selection on portal

    Vault access policy

    BrunoLucasAzure already explained how this works. Personally I don’t recommend using vault access policy unless you have some specific reason to use it:

    For more information: https://docs.microsoft.com/azure/key-vault/general/assign-access-policy-portal

    Azure role-based access control

    Azure role-based access control based key vault authorization uses Azure RBAC assignments for key vault data layer access control.

    There is multiple ready-made RBAC roles for key vault data layer:

    • Key Vault Administrator
    • Key Vault Secrets Officer
    • Key Vault Secrets User
    • Key Vault Reader
    • etc

    Documentation only mentions thins Azure RBAC for key vault also provides the ability to have separate permissions on individual keys, secrets, and certificates
    => you can add RBAC roles into individual key/secret/certificate

    Note that key/secret/certificate must be created before you can add RBAC to it.

    secret level RBAC on portal

    For more information: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

    The answer

    You can use both methods:

    • if you use older vault access policy, you need to create one key vault per service principal
    • if you use RBAC based access control, you can manage access control on individual secret level
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search