← cd ~/roles
// roles/azure · security
Key Vault Crypto Service Encryption UserAzure built-in role
Read metadata of keys and perform wrap/unwrap operations. Only works for key vaults that use the 'Azure role-based access control' permission model.
| Role ID | e147488a-f6f5-4113-8e2d-b22465e65bf6 |
|---|---|
| Category | Security |
| Actions | 3 |
| Data actions | 3 |
Before you assign it
- It reaches the data, not just the resource. It has 3 data actions, such as reading blobs, secrets or messages.
What it can do
| Permission | What it allows |
|---|---|
Microsoft.EventGrid/eventSubscriptions/write | Create or update an eventSubscription |
Microsoft.EventGrid/eventSubscriptions/read | Read an eventSubscription |
Microsoft.EventGrid/eventSubscriptions/delete | Delete an eventSubscription |
Data actions
| Permission | What it allows |
|---|---|
Microsoft.KeyVault/vaults/keys/read | List the keys in a specified vault, or read the current version of a specified key. |
Microsoft.KeyVault/vaults/keys/wrap/action | Wraps a symmetric key with a Key Vault key. Note that if the Key Vault key is asymmetric, this operation can be performed by principals with read access. |
Microsoft.KeyVault/vaults/keys/unwrap/action | Unwraps a symmetric key with a Key Vault key. |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "Key Vault Crypto Service Encryption User" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "Key Vault Crypto Service Encryption User" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, 'e147488a-f6f5-4113-8e2d-b22465e65bf6')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "e147488a-f6f5-4113-8e2d-b22465e65bf6"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other security roles
- App Compliance Automation Reader · 1 permission
- Key Vault Crypto Service Release User · 1 permission
- Security Assessment Contributor · 1 permission
- Attestation Reader · 2 permissions
- Key Vault Secrets User · 2 permissions
- Attestation Contributor · 3 permissions
- Locks Contributor · 3 permissions
- Key Vault Certificate User · 4 permissions