CODEWITHSUNDEEP
azure-devopsazure-active-directoryazure-keyvault
Stringfellow
Stringfellow

Reputation: 2908

Azure AD Permissions Needed for Service Principal for Set-AzKeyVaultAccessPolicy

What are the Azure AD permissions needed for the 'App registration' that is used in an Azure DevOps (ADO) Service Principal to execute a IaC release pipeline that calls Set-AzKeyVaultAccessPolicy?

I am trying to add access to the Key Vault for a Microsoft.ManagedIdentity/userAssignedIdentities.

The error I see is: "WARNING: Please make sure you have sufficient permissions in AD Graph to get and list graph objects for validation to work. Otherwise skip witch -BypassObjectIdValidation."

I have tried numerous combinations of AAD 'read' permissions. The current permissions I have reverted to are: enter image description here

When I test locally using my personal login the script works fine, the access policy gets added, and the 'Managed Identity' is able to access the Key Vault secret. I have been able to use -BypassObjectIdValidation as a workaround in ADO but that seems like a hack. All of the Azure resources are in the same subscription and all objects are in the same Azure tenant, so it doesn't make sense to me that I should need to use the bypass switch.

Additional Info:

Digging into Microsoft's source, I'm further convinced the problem is within the service principal's AAD permissions. For example, the following code is calling into Graph.

if (!this.BypassObjectIdValidation.IsPresent && ActiveDirectoryClient != null)
{
    objId = GetObjectId(this.ObjectId, this.UserPrincipalName, this.EmailAddress, this.ServicePrincipalName);
}
else if (ActiveDirectoryClient == null && objId == null)
{
    throw new Exception(Resources.ActiveDirectoryClientNull);
}

Source: https://github.com/Azure/azure-powershell/blob/a31eaed8e1d4f52752222d138436ce975b05dd5f/src/KeyVault/KeyVault/Commands/SetAzureKeyVaultAccessPolicy.cs#L519

Continuing deeper:

adObjects = GraphClient.Objects.GetObjectsByObjectIds(new GetObjectsParameters { ObjectIds = objectIdBatch, IncludeDirectoryObjectReferences = true });

Source: https://github.com/Azure/azure-powershell/blob/a31eaed8e1d4f52752222d138436ce975b05dd5f/src/Resources/Resources/ActiveDirectory/Models/ActiveDirectoryClient.cs#L280

Upvotes: 1

Views: 1415

Answers (2)

Stringfellow
Stringfellow

Reputation: 2908

Apparently the problem is a 'known product limitation'. https://github.com/Azure/azure-powershell/issues/10029#issuecomment-664485033

About a third of the way down in the help document: enter image description here

Source: https://learn.microsoft.com/en-us/powershell/module/az.keyvault/set-azkeyvaultaccesspolicy?view=azps-5.5.0#description

So it seems there is no combination of permissions that can set to enable the commandlet to work without the switch.

Upvotes: 2

WaitingForGuacamole
WaitingForGuacamole

Reputation: 4301

It's an access control permission by RBAC role on the Key Vault.

Our setup gives the Azure DevOps service connection principal Contributor on the subscription, and that's sufficient. The docs verify, in fact that you should be careful who has Contributor on your Vaults, because they can give themselves access policies (where they normally can't in Azure).

If you want fewer privileges, I'd try User Access Administrator or Key Vault Administrator.

Upvotes: 0

Related Questions