{"id":3884,"date":"2022-05-12T10:23:47","date_gmt":"2022-05-12T09:23:47","guid":{"rendered":"https:\/\/www.lieben.nu\/liebensraum\/?p=3884"},"modified":"2022-05-12T10:23:47","modified_gmt":"2022-05-12T09:23:47","slug":"keyvault-rbac-model-arm-role-assignment","status":"publish","type":"post","link":"https:\/\/lieben.nu\/liebensraum\/2022\/05\/keyvault-rbac-model-arm-role-assignment\/","title":{"rendered":"Keyvault RBAC model ARM role assignment"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Yes, using ARM, not Bicep, I know, it&#8217;s bad!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ran into a whole bunch of constrains and issue trying to assign an array of principals vs roles on keyvault using the RBAC access method, so sharing my working solution here as I couldn&#8217;t find a single good example on google:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: jscript; title: ; notranslate\" title=\"\">\n        {\n            \"type\": \"Microsoft.KeyVault\/vaults\/providers\/roleAssignments\",\n            \"apiVersion\": \"2018-09-01-preview\",\n            \"copy\": {\n                \"name\": \"rbac-access-policy-loop\",\n                \"count\": \"&#x5B;length(parameters('accessPolicies'))]\"\n            },            \n            \"name\": \"&#x5B;concat(variables('vaultName'),'\/Microsoft.Authorization\/',guid(concat(variables('vaultName'), parameters('accessPolicies')&#x5B;copyIndex('rbac-access-policy-loop')].objectId, parameters('accessPolicies')&#x5B;copyIndex('rbac-access-policy-loop')].roleId)))]\",\n            \"dependsOn\": &#x5B;\n                \"&#x5B;resourceId('Microsoft.KeyVault\/vaults', variables('vaultName'))]\"\n            ],\n            \"properties\": {\n                \"roleDefinitionId\": \"&#x5B;concat('\/providers\/Microsoft.Authorization\/roledefinitions\/',parameters('accessPolicies')&#x5B;copyIndex('rbac-access-policy-loop')].roleId)]\",\n                \"principalId\": \"&#x5B;parameters('accessPolicies')&#x5B;copyIndex('rbac-access-policy-loop')].objectId]\",\n                \"scope\": \"&#x5B;resourceId('Microsoft.KeyVault\/vaults', variables('vaultName'))]\",\n                \"principalType\": \"Group\"\n            }\n        }   \n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">An example param would then look like this:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: jscript; title: ; notranslate\" title=\"\">\n        \"accessPolicies\": {\n            \"value\": &#x5B;\n                {\n                    \"roleId\": \"b86a8fe4-44ce-4948-aee5-eccb2c155cd7\",\n                    \"objectId\": \"2d9cbd23-20b1-4921-a8e4-54b55161ad04\"\n                }                \n            ]\n        }  \n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Yes, using ARM, not Bicep, I know, it&#8217;s bad! Ran into a whole bunch of constrains and issue trying to assign an array of principals vs roles on keyvault using the RBAC access method, so sharing my working solution here as I couldn&#8217;t find a single good example on google: An example param would then &hellip; <a href=\"https:\/\/lieben.nu\/liebensraum\/2022\/05\/keyvault-rbac-model-arm-role-assignment\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Keyvault RBAC model ARM role assignment<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[49,5],"tags":[],"class_list":["post-3884","post","type-post","status-publish","format-standard","hentry","category-arm","category-azure"],"_links":{"self":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/3884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/comments?post=3884"}],"version-history":[{"count":0,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/posts\/3884\/revisions"}],"wp:attachment":[{"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/media?parent=3884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/categories?post=3884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lieben.nu\/liebensraum\/wp-json\/wp\/v2\/tags?post=3884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}