Azure Key Vault - Access Policy Update via ARM Template

29. May 2018 Matt Small Key Vault Comments (11)

I've seen several support cases recently where someone wants to update a Key Vault via template but not disturb the existing access policies. The problem is that if you deploy a resource of type Microsoft.KeyVault/vaults, that will replace any existing access policy.

This is by-design of ARM Templates.  

In speaking with the product team, I learned of a special child resource for ARM template which allows the addition of new access policies without affecting existing access policies.

When you deploy a resource of type Microsoft.KeyVault/vaults/accessPolicies with the name “add”, it will merge in your changes. This special child resource type was created to allow Managed Service Identity scenarios where you don’t know the identity of a VM until the VM is deployed and you want to give that identity access to the vault during deployment. 

An incremental deployment can be used along with this json to achieve the objective:

{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vaultName": {
            "type": "string"
        }
    },
    "resources": [
        {
            "type": "Microsoft.KeyVault/vaults/accessPolicies",
            "name": "[concat(parameters('vaultName'), '/add')]",
            "apiVersion": "2016-10-01",
            "properties": {
                "accessPolicies": [
                    {
                        "tenantId": "dfe47ca8-acfc-4539-9519-7d195a9e79e4",
                        "objectId": "5abe9358-10ae-4195-ba23-d34111430329",
                        "permissions": {
                            "keys": ["all"],
                            "secrets": ["all"],
                            "certificates": ["all"],
                            "storage": ["all"]
                        }
                    }
                ]
            }
        }
    ],
    "outputs": {
    }
}

I hope this helps you out when using the Azure Key Vault!  Please follow us on Twitter and retweet!
@WinDevMatt @AzIdentity

Tags:

Comments (11) -

Joey Chömpff 7/30/2018 11:32:29 AM

Is it possible to access a keyvault store which is located inside another resource group?

Reply
Matt Small 8/16/2018 9:15:26 PM

Yes, I believe this should be possible as it's not a cross-tenant action.

Reply
Derek Brown 9/25/2018 9:08:30 PM

How would I accomplish this? My keyvault is in a different subscription & resource group than the msi enabled app I'm trying to grant access.

I tried giving the fully qualified ID as the name of the resource (ex. "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<keyvault-name>/name") but received the following error: "The template resource '/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<keyvault-name>/add' for type 'Microsoft.KeyVault/vaults/accessPolicies' at line '111' and column '9' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name."

If I set the resource name as "<keyvault-name>/add", I get the following error: "Can not perform requested operation on nested resource. Parent resource '<keyvault-name>' not found."

I can probably get the job done using the powershell commands, but, I'd prefer to keep it in the arm template if possible.

Reply
PIYUSH 3/4/2019 1:45:41 PM

Any update @Derek Brown? i am stuck in a similar situation?

Reply
Alexander Batishcehv 2/29/2020 5:44:27 AM

It's quite doable, see blog.abatishchev.ru/.../

Reply
Markuz 4/8/2019 9:45:07 PM

Any solution for added accesspolicies to a keyvault instance that is location within an other resource group, via ARM?

Reply
JCaddy 5/30/2019 11:51:41 PM

Totally stuck on this too. Surely it must be possible to build an ARM template which creates a new web app and adds an access policy to a Keyvault instance that is located in another resource group. SURELY - everyone must want that? Too many brick walls with these darn templates... I may switch to AZ CLI scripts.

Reply
Gary 8/29/2019 3:44:33 AM

For me I can deploy this via arm template directly from visual studio or azure powershell however when its in a devops Azure resource group deployment task sequence it doesn't seem to like the /add. I get:

"error": {
    "code": "BadRequest",
    "message": "Bad JSON content found in the request."
  }

Reply
Qinqin Wang 10/12/2019 7:39:49 AM

Hello Matt,
Is it possible to add this child resource inside a key_vault resource in one template(not 2 separate ones), and will not impact the existing access policies within the key_vault?
In my case, there are some manually added policies in key_vault, and if I redeploy  key_vault resource template, the manfully added policies would gone, so I'd like to change

Reply
Filip 12/17/2019 2:05:55 PM

I'm getting "Can not perform requested operation on nested resource. Parent resource '{key-vault-name}' not found.".
The key vault with name provided does exist. Any idea?

Reply
Alberto S 6/24/2020 7:49:12 AM

Wow, thanks so much for this post. Ms documentation doesnt mention this endpoint, thanks!!

Reply

Add comment