You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1) Now we have a App registration and values for _Directory (tenant) ID_, _Application (client) ID_. These will be used by the integration for authentication to Azure.
28
+
1) Now we have a App registration and values for _Directory (tenant) ID_, _Application (client) ID_. These will be used
29
+
by the integration for authentication to Azure.
26
30
27
-
1) (Optional) If creating a multi-tenant service principal, the following AzureAD Powershell command must be run in each tenant:
31
+
1) (Optional) If creating a multi-tenant service principal, the following AzureAD Powershell command must be run in each
In order to be able to discover and create new Azure Keyvault certificate stores, the app principal that we created must be provided with the "Keyvault Administrator" role at the _Resource Group_ level.[^1]
39
+
In order to be able to discover and create new Azure Keyvault certificate stores, the app principal that we created must
40
+
be provided with the "Keyvault Administrator" role at the _Resource Group_ level.[^1]
35
41
_If there are multiple resource groups that will contain Key Vaults to be managed, you should repeat for each._
36
42
37
43
Here are the steps for assigning this role.
@@ -40,76 +46,93 @@ Here are the steps for assigning this role.
40
46
1) Select "Access control (IAM)" from the left menu.
41
47
1) Click "Add", then "Add Role Assignment" to create a new role assignment
42
48
43
-
49
+
44
50
1) Search and Select the "Key Vault Administrator" role.
1) Click "Review and Assign" and save the role assignment.
49
55
50
-
[^1]: If discovery and create store functionality are not neeeded, it is also possible to manage individual certificate stores without the need to provide resource group level authority. The steps to do assign permissions for an individual Azure Keyvault are described [here](#assign-permissions-for-an-individual-key-vault-via-access-policy) for vaults using Access Policy based permissions and [here](#assign-permissions-for-an-individual-key-vault-via-rbac) for Individual Key Vaults using Role-Based Access Control (RBAC).
56
+
[^1]: If discovery and create store functionality are not neeeded, it is also possible to manage individual certificate
57
+
stores without the need to provide resource group level authority. The steps to do assign permissions for an individual
58
+
Azure Keyvault are described [here](#assign-permissions-for-an-individual-key-vault-via-access-policy) for vaults using
59
+
Access Policy based permissions and [here](#assign-permissions-for-an-individual-key-vault-via-rbac) for Individual Key
60
+
Vaults using Role-Based Access Control (RBAC).
51
61
52
62
#### Assign Permissions for an Individual Key Vault via RBAC
53
63
54
-
If you only need to manage a single instance of a Key Vault and do not require creation and discovery of new Key Vaults, you can provision access to the specific instance without needing to provide the service principal the "Keyvault Administrator" role at the resource group level.
64
+
If you only need to manage a single instance of a Key Vault and do not require creation and discovery of new Key Vaults,
65
+
you can provision access to the specific instance without needing to provide the service principal the "Keyvault
66
+
Administrator" role at the resource group level.
55
67
56
-
Follow the below steps in order to provide management access for our service principal to a specific instance of a Key Vault:
68
+
Follow the below steps in order to provide management access for our service principal to a specific instance of a Key
69
+
Vault:
57
70
58
71
1) Navigate to the Azure Portal and then to your instance of the Azure Keyvault
59
72
60
73
1) Go to "Access control (IAM)" in the navigation menu for the Key vault.
61
74
62
75
1) Click on "Add role assignment"
63
76
64
-
77
+
65
78
66
-
1) Find the Keyvault Administrator role in the list. Select it and click "Next"
79
+
1) Find the Keyvault Administrator role in the list. Select it and click "Next"
1) Select the service principal, click "select", and then "Next"
75
88
76
89
1) On the final screen, you should see something similar to the following:
77
90
78
-
91
+
79
92
80
-
1) Click "Review + assign" to finish assigning the role of Keyvault Administrator for this Key Vault to our service principal account.
93
+
1) Click "Review + assign" to finish assigning the role of Keyvault Administrator for this Key Vault to our service
94
+
principal account.
81
95
82
96
#### Assign Permissions for an Individual Key Vault via Access Policy
83
97
84
-
Access to an Azure Key Vault instance can be granted via Role Based Access Control (RBAC) or with class Azure Resource Access Policies. The below steps are for provisioning access to a single instance of a Key Vault using Access Policies. If you are using RBAC at the resource group level (necessary for discovery and creating new Key Vaults via Keyfactor) we recommend following RBAC (above). Alternatively, you will need to assign explicit permissions to the service principal for any Key Vault that is using Access Policy for Access Control if the Key Vault should be managed with Keyfactor.
98
+
Access to an Azure Key Vault instance can be granted via Role Based Access Control (RBAC) or with class Azure Resource
99
+
Access Policies. The below steps are for provisioning access to a single instance of a Key Vault using Access Policies.
100
+
If you are using RBAC at the resource group level (necessary for discovery and creating new Key Vaults via Keyfactor) we
101
+
recommend following RBAC (above). Alternatively, you will need to assign explicit permissions to the service principal
102
+
for any Key Vault that is using Access Policy for Access Control if the Key Vault should be managed with Keyfactor.
85
103
86
-
Following the below steps will provide our service principal with the ability to manage keys in an existing vault, without providing it the elevated permissions required for discovering existing vaults or creating new ones. If you've completed the steps in the previous section for the resource group that contains the Key Vault(s) you would like to manage and the Key Vault(s) are using RBAC, the below steps are not necessary.
104
+
Following the below steps will provide our service principal with the ability to manage keys in an existing vault,
105
+
without providing it the elevated permissions required for discovering existing vaults or creating new ones. If you've
106
+
completed the steps in the previous section for the resource group that contains the Key Vault(s) you would like to
107
+
manage and the Key Vault(s) are using RBAC, the below steps are not necessary.
87
108
88
109
1) Navigate to the Azure Portal and then to your instance of the Azure Keyvault.
89
110
90
111
1) Go to "Access Policies" in the navigation menu for the Key vault.
91
112
92
113
1) Click "+ Add Access Policy"
93
114
94
-
1) In the first drop-down, you can select "Certificate Management". This will select all certificate management permissions.
115
+
1) In the first drop-down, you can select "Certificate Management". This will select all certificate management
0 commit comments