scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-31 02:28:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

secrets/azure: adds permissions note on rotate root and change role assignment (#22024)

Browse Source
This commit is contained in:
Austin Gebauer
2023-07-21 14:58:11 -07:00
committed by GitHub
parent fe013a987a
commit 4811ef9cc3
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
website/content/docs/secrets/azure.mdx
View File

@@ -237,6 +237,9 @@ service principals.
| Application.ReadWrite.OwnedBy | Application | | Application.ReadWrite.OwnedBy | Application |
| GroupMember.ReadWrite.All | Application | | GroupMember.ReadWrite.All | Application |
~> **Note**: If you plan to use the [rotate root](/vault/api-docs/secret/azure#rotate-root)
credentials API, you'll need to change `Application.ReadWrite.OwnedBy` to `Application.ReadWrite.All`.
#### Existing Service Principals #### Existing Service Principals
| Permission Name | Type | | Permission Name | Type |
@@ -251,8 +254,8 @@ must be granted in order for the secrets engine to manage role assignments for s
principles it creates. principles it creates.
| Role | Scope | Security Principal | | Role | Scope | Security Principal |
| ----- | ------------ | ------------------------------------------- | |------------------------------------------------| ------------ | ------------------------------------------- |
| Owner | Subscription | Service Principal ID given in configuration | | [User Access Administrator][user_access_admin] | Subscription | Service Principal ID given in configuration |
## Choosing between dynamic or existing service principals ## Choosing between dynamic or existing service principals
@@ -320,3 +323,4 @@ for more details.
[api]: /vault/api-docs/secret/azure [api]: /vault/api-docs/secret/azure
[config]: /vault/api-docs/secret/azure#configure-access [config]: /vault/api-docs/secret/azure#configure-access
[repo]: https://github.com/hashicorp/vault-plugin-secrets-azure [repo]: https://github.com/hashicorp/vault-plugin-secrets-azure
[user_access_admin]: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator