adaptive.run
Transform your business.
Run adaptive.
Contact
Phone: +40 73 523 0005
Email: hello@adaptive.run
Cloud can be tricky sometimes. Find out what scenarios we've ran into that are worth being mentioned and explained.
Here's an example of how to create a Bicep file:
// Define a KeyVault resource
resource keyVault "Microsoft.KeyVault/vaults" = {
name: "myKeyVault",
location: "West Europe",
properties: {
sku: {
name: "standard"
},
tenantId: "",
accessPolicies: [
{
tenantId: "",
objectId: "",
permissions: {
keys: [ "get" ],
secrets: [ "get" ]
}
}
]
}
}
// Define a KeyVault access policy
resource keyVaultAccessPolicy "Microsoft.KeyVault/vaults/accessPolicies" = {
name: "myKeyVault/readAccess",
properties: {
keyVaultId: keyVault.id,
tenantId: "",
objectId: "",
permissions: {
keys: [ "get" ],
secrets: [ "get" ]
}
}
}
Here's an example of how to deploy the Bicep file:
az deployment create --template-file keyvault.bicep --parameters key
Lesson 5: Assigning Access Policies to KeyVault with Bicep across multiple Resource Groups
When working with multiple resource groups, the process of assigning access policies can become more complicated. When multiple resource groups are involved, it's important to ensure that the correct policies are assigned to the correct KeyVault and resource group. This can be accomplished by creating separate Bicep files for each resource group and referencing the correct KeyVault in each file.
Scenario:
In this scenario, we have a development environment where multiple developers need access to the Key Vault, but the secrets they need to access are in different resource groups. To accomplish this, we will use Bicep to assign access policies to the Key Vault.
Here's an example of a Bicep file for assigning access policies to Key Vault across multiple resource groups:
module keyvault {
resource keyVault 'Microsoft.KeyVault/vaults/@{variables("keyVaultName")}' {
name : variables("keyVaultName")
location : resourceGroup().location
properties: {
tenantId: subscription().tenantId
sku: {
name: "standard"
}
accessPolicies: [
{
tenantId: subscription().tenantId
objectId: "developer1@contoso.com"
permissions: {
secrets: [
{
actions: [
"Microsoft.KeyVault/secrets/list"
]
excludeScopes: []
keyId: resourceId("ResourceGroup1/Microsoft.KeyVault/secrets/secret1")
}
]
}
},
{
tenantId: subscription().tenantId
objectId: "developer2@contoso.com"
permissions: {
secrets: [
{
actions: [
"Microsoft.KeyVault/secrets/get"
]
excludeScopes: []
keyId: resourceId("ResourceGroup2/Microsoft.KeyVault/secrets/secret2")
}
]
}
}
]
}
}
}
Transform your business.
Run adaptive.
Phone: +40 73 523 0005
Email: hello@adaptive.run
