限制对 Azure Key Vault 的访问

Question

I want to create an Azure key vault with fairly restricted access (one or two of our apps). I've created the Key Vault through the Azure portal, but when I look at the Access Control section, I find that several Apps and Users have the Contributor role (inherited from the subscription) for the key vault, which gives them more access than they should have.

Since the subscription is the highest level at which access control can be set, there is no way for me to revoke access for these apps/users without revoking it at the subscription level, and this would probably cause all sorts of problems. (it's not really clear what permissions these need, so it'd be a bit painful to have to give those permissions at a resource group or resource level). What's more, there'd be nothing stopping someone who comes along later from adding contributor roles at the subscription level (for some new app, for instance), and breaking the security of the key vault.

So with all of this in mind, what would be the best way to limit access to an azure key vault, so that only the apps/users I want have access to it, despite the fact that several apps/users already have these permissions at the subscription level?

More info: We're using the Azure Resource Manager model, and everything is currently stored in one subscription.

Answer 1

It looks like you can not achieve this with the way RBAC works today.

Here are a couple of feedback requests already running on Feedback Forums - https://feedback.azure.com . One is for Key Vault and another takes the example of a storage account but essentially looking for the same feature to override the inherited permissions.

You may want to vote up for these requests.

1. Deny users with inherited permissions to Azure Key Vault Service from modifying Access Policies

2. Exclude / override RBAC permissions inhereted from a subscription at a resource group level

UPDATE (to answer additional queries from comments):

Not granting subscription-level access in the first place (except to admins)

Yes this would definitely help.

Another suggestion would be to try and use Resource Groups to organize your resources and then assign roles on these Resource Groups (scope). This way, you don't need to give access to individual items, but at the same time you can avoid giving access at the highest level of subscription.

Answer 2

An option you have is to create a blueprint that you can use to configure locks on your keyvaults. If you deploy this BP as readonly the locks can't be removed from your vault so no-one can alter te permissions of your vault until you change the blueprint config again to don't lock and then remove the lock from your vault.

Applications etc having access to your vault (aka dataplane) de still access the keys ofcource