scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 18:17:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

secrets/azure: adds permissions note on rotate root and change role assignment (#22024)

Browse Source
This commit is contained in:
Austin Gebauer
2023-07-21 14:58:11 -07:00
committed by GitHub
parent fe013a987a
commit 4811ef9cc3
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
website/content/docs/secrets/azure.mdx
View File

@@ -237,6 +237,9 @@ service principals.
| Application.ReadWrite.OwnedBy | Application | | Application.ReadWrite.OwnedBy | Application |
| GroupMember.ReadWrite.All | Application | | GroupMember.ReadWrite.All | Application |
~> **Note**: If you plan to use the [rotate root](/vault/api-docs/secret/azure#rotate-root)
credentials API, you'll need to change `Application.ReadWrite.OwnedBy` to `Application.ReadWrite.All`.
#### Existing Service Principals #### Existing Service Principals
| Permission Name | Type | | Permission Name | Type |
@@ -250,9 +253,9 @@ The following Azure [role assignments](https://learn.microsoft.com/en-us/azure/r
must be granted in order for the secrets engine to manage role assignments for service must be granted in order for the secrets engine to manage role assignments for service
principles it creates. principles it creates.
| Role | Scope | Security Principal | | Role | Scope | Security Principal |
| ----- | ------------ | ------------------------------------------- | |------------------------------------------------| ------------ | ------------------------------------------- |
| Owner | Subscription | Service Principal ID given in configuration | | [User Access Administrator][user_access_admin] | Subscription | Service Principal ID given in configuration |
## Choosing between dynamic or existing service principals ## Choosing between dynamic or existing service principals
@@ -320,3 +323,4 @@ for more details.
[api]: /vault/api-docs/secret/azure [api]: /vault/api-docs/secret/azure
[config]: /vault/api-docs/secret/azure#configure-access [config]: /vault/api-docs/secret/azure#configure-access
[repo]: https://github.com/hashicorp/vault-plugin-secrets-azure [repo]: https://github.com/hashicorp/vault-plugin-secrets-azure
[user_access_admin]: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator