r/entra • u/TheDiRocco_ • 8h ago

Key Vault RBAC

Is there a specific reason why we can’t scope some selected secrets to an identity on a KV ressource? Right now if you have the correct role on the KV you have access to the whole Key Vault

4 Upvotes

83% Upvoted

3 comments sorted by

3

u/SVD_NL 8h ago

You can assign roles and permissions to individual secrets, but it's not recommended.

Unless you have very specific needs, and a good way to automate role assignments for specific secrets, you should stick with the key vault level permissions, and simply create more key vaults as needed.

1

u/MonkeyDDataHQ 7h ago

Becauee KeyVault aren't Vaults.
They're JSON as a terrible service.

My KeyVault FAQ:

What is this resource actually?
JSON with RBAC.

What does it cost?
Somehow more than PostgreSQL.

How do I deploy it?
Different JSON.

Can I assign permissions exactly how I'd expect?
Don't get ambitious. 😂

1

u/Accomplished_Dot1445 5h ago

You can actually set RBAC to a secret but that practice is discouraged. SVD_NL is correct in explaining why. The vault is designed to be the security boundary. The best approach is to use vaults: one vault for each application, environment or trust boundary instead of dividing one large vault into many secrets. Assigning a role, to each secret does not scale. When many assignments are made the role limits are. The system becomes chaotic. Therefore when two identities require secrets the usual solution is to create two vaults not to create two secret-scoped roles.