0

We are setting up an Azure App Service (Web app) that needs to get some secrets from a Key vault. For this, we have enabled System assigned identity for the web app. The Key vault is using RBAC and we decided to create an Azure AD group to give access. We added a role assignment (Key Vault Secrets Officer) on the Key vault for the Azure AD group.

In the app service, I can go to "Identity" and press on the button for "Azure role assignments". Here I see the role assignment made: enter image description here

However, if I go to Application settings, it says that it does not have access. I have given it about 3 hours, without success. I have restarted and updated other settings to trigger restart.

enter image description here

If I put myself to this Azure AD group I get access to go and work with secrets.. Any ideas why this is the case? Is this not supported for RBAC yet?

Thanks!

mr3k
  • 188
  • 3
  • 17
  • access denied is probably more related to networking. is there any firewall rules/vnet integration associated to this kv ? – Thomas Jun 04 '22 at 05:51
  • Hi @Thomas! Unfortunately this is not caused by networking – mr3k Jun 07 '22 at 11:09

1 Answers1

-1

I see you have Azure key vault officer permission to the group .

NOTE:

  1. Please note that azure AD Groups with Managed Identities may require up to eight(8) hours to refresh tokens and become effective.
  2. The application also needs at least one Identity and Access Management (IAM) role assigned to the key vault or else the access policies to access .
  • In case even if you have given a particular user individually , the RBAC permsission, Your app needs the proper access permssions to access keyvault. i.e;the managed identity has been generated but not granted access on key vault yet. So, go to the key vault in Azure portal, which you need to be accessed by the required azure app service.
  • You can check in the process of access permissions needed here in create-and-assign-a-managed-identity in Azure web app | Microsoft Docs.

You can give RBAC to that Application /user/service principal or give access policies like below.

  1. Under Settings in azure keyvault, select access policies option from left navigation and then click on Add access policy.

enter image description here

  1. Here make sure to select atleast two permissions – Get and List – for key permissions, secret permissions and certificate permissions inputs which are least possible permissions to access keyvault by app service app.You can provide the other access permissions if needed.

  2. Under Select principal, choose the None selected link to open the Principal selection pane. Enter the name of the user/group, app or service principal in the search field, select the appropriate result, then choose Select. As you are using a managed identity for the app, select the name of the app in the app service itself by selecting add and then saving the changes.

enter image description here

If your vault is configured with network restrictions, you must ensure the application has network access.

Please check this Assign an Azure Key Vault access policy (CLI) | Microsoft Docs for detailas.

References:

  1. access-network-restricted-vaults
  2. Using Azure RBAC with Azure Key Vault - Joonas W's blog
kavyaS
  • 8,026
  • 1
  • 7
  • 19
  • Hi! Thank you for the reply. As described, we do not want to use access policies, instead we want to use RBAC. Do you see any trouble in us giving RBAC access through an Azure AD group for managed identities? I can confirm that this is working just fine for a regular identity, but not from App Service system identity. – mr3k Jun 09 '22 at 14:10
  • @mr3k, have you changed the setting for permission model on the Access policies tab to 'Azure role-based access control' – kavyaS Jun 09 '22 at 14:30
  • Also please check [this](https://www.seb8iaan.com/azure-ad-role-assignable-groups/) and [this one](https://stackoverflow.com/questions/67658341/key-vault-access-denied-in-azure-web-app-configuration-setting) , if you are missing any steps. – kavyaS Jun 09 '22 at 14:51
  • yes I have confirmed permission model as RBAC. Also the other links you sent. I can assign the web app's identity directly to the Key Vault for the role without problem, but when trying to inherit it through an Azure AD group it fails. Is this a limitation maybe? – mr3k Jun 10 '22 at 11:54