Repository navigation
Update Key Vault to Support RBAC Permissions and Delete Protection #1067
Description
⚠️ Problem
For organizations that utilize the Enterprise Scale in association with the Cloud Adoption Framework (CAF), there are various Azure Policies and Initiatives that are deployed.
One of those Initiatives is the Enforce recommended guardrails for Azure Key Vault. This initiative contains several policies, including:
- Azure Key Vault should use RBAC permission model
- Key vaults should have deletion protection enabled
The current deployment of the FinOps Toolkit (Hub architecture), violates those 2 policies and prevents its deployment. We have to add/create an exception in the target Subscription / Resource Group, for the deployment to complete successfully.
🛠️ Solution
Update the FinOps Toolkit's Key Vault implementation to support the RBAC permissions model, and also enable delete protection.
ℹ️ Additional context
The client I am currently assisting, is in a regulated industry, and uses the CAF / Enterprise Scale Terraform modules.
🙋♀️ Ask for the community
We could use your help:
- Please vote this issue up (👍) to prioritize it.
- Leave comments to help us solidify the vision.
Activity
flanakin commentedon Oct 23, 2024
Makes sense. I'm not familiar with these options, but we can probably look at this in December. If you're familiar with bicep and would like to see this sooner, we'd welcome a PR to add this. Or if you know the settings that need to be applied, you could share them here, which might speed things up. Just let us know.
Either way, thanks for the feedback!
flanakin commentedon Oct 23, 2024
allcontributors[bot] (@allcontributors) please add AErmie for feature
allcontributors commentedon Oct 23, 2024
Michael Flanakin (@flanakin)
I couldn't determine any contributions to add, did you specify any contributions?
Please make sure to use valid contribution names.
AErmie commentedon Oct 29, 2024
Michael Flanakin (@flanakin), I believe the REST API properties are:
enableRbacAuthorizationenableSoftDeleteenablePurgeProtectionSee: https://learn.microsoft.com/en-us/rest/api/keyvault/keyvault/vaults/create-or-update?view=rest-keyvault-keyvault-2022-07-01&tabs=HTTP#vaultproperties
Update keyVault.bicep
ankurshukla03 commentedon Feb 28, 2025
#1349 - Added the PR request to enable purge protection for the keyvault as per this issue
2 remaining items
Add opt-in Key Vault RBAC authorization for CAF/landing zone compliance
Add opt-in Key Vault RBAC authorization for CAF/landing zone compliance
Add opt-in Key Vault RBAC authorization for CAF/landing zone compliance