azureblog.co.uk
← cd ~/roles
// roles/azure · security

Key Vault ReaderAzure built-in role

Read metadata of key vaults and its certificates, keys, and secrets. Cannot read sensitive values such as secret contents or key material. Only works for key vaults that use the 'Azure role-based access control' permission model.

Role ID21090545-7ca7-4776-b22c-e363652d74d2
CategorySecurity
Actions9
Data actions2

Before you assign it

  • It reaches the data, not just the resource. It has 2 data actions, such as reading blobs, secrets or messages.

What it can do

PermissionWhat it allows
Microsoft.Authorization/*/readAny read operation on anything under Microsoft.Authorization
Microsoft.Insights/alertRules/*Every operation under Microsoft.Insights/alertRules
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.Support/*Every operation under Microsoft.Support
Microsoft.KeyVault/checkNameAvailability/readChecks that a key vault name is valid and is not in use
Microsoft.KeyVault/deletedVaults/readView the properties of soft deleted key vaults
Microsoft.KeyVault/locations/*/readAny read operation on anything under Microsoft.KeyVault/locations
Microsoft.KeyVault/vaults/*/readAny read operation on anything under Microsoft.KeyVault/vaults
Microsoft.KeyVault/operations/readLists operations available on Microsoft.KeyVault resource provider

Data actions

PermissionWhat it allows
Microsoft.KeyVault/vaults/*/readAny read operation on anything under Microsoft.KeyVault/vaults
Microsoft.KeyVault/vaults/secrets/readMetadata/actionList or view the properties of a secret, but not its value.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Key Vault Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Key Vault Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '21090545-7ca7-4776-b22c-e363652d74d2')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "21090545-7ca7-4776-b22c-e363652d74d2"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other security roles

Find the smallest role for a task →

Sources