CODEWITHSUNDEEP
azure-active-directoryazure-keyvaultazure-securityazure-rbac
Dhiraj
Dhiraj

Reputation: 3696

Subscription level Role similar to Reader but preventing Key Vault secret access & storage key access

I am looking for some RBAC role at subscription level, something like 'Reader' but unlike Reader, it should not allow accessing Key Vault secrets and Azure Storage blob keys. Is there any such role at subscription level?

Upvotes: 0

Views: 1327

Answers (1)

Joy Wang
Joy Wang

Reputation: 42063

something like 'Reader' but unlike Reader, it should not allow accessing Key Vault secrets and Azure Storage blob keys.

In your case, the Reader role is suitable.

To access the azure keyvault secret/key/certificate, the user needs to assigned corresponding permissions like get, list, set, delete in Access policies. Without the permissions, he will not be able to access them. But you should note, don't assign the user as the Owner/Contributor/Key Vault Contributor roles(maybe there are other roles, just a tip), because the user with these roles can add himself to the Access policies. More details about keyvault access control, see this link.

To access the Azure Storage blob keys, the user will need Microsoft.ClassicStorage/storageAccounts/listKeys/action permission which the Reader does not have, so it is also suitable.

Have a test for you with the Reader role:

Storage:

enter image description here

Keyvault:

enter image description here

enter image description here

enter image description here

Upvotes: 1

Related Questions