ankn
a5f8fb49ab
Bahn: aisupport, Analyse-O2C-C2S, awesome-bahn-mcp-servers, beam-mcp,
Confluence_Bot, db-planet-mcp-server, O2C-Harness, project-audit,
Projekt-KIQ-HP, teamlandkarte-mcp
Dhive: Jury-Voting
Privat: CV, NoteGraph (NOTE: NoteGraph needs complete redo after consolidation)
Shared: AI-Orchestrator, OrgMyLife, power_skills_and_more
Shared/references: symphony (read-only)
Bahn repos remain available as independent remotes - this monorepo
pulls them in via subtree, the originals are untouched.
60 lines
2.0 KiB
Bicep
60 lines
2.0 KiB
Bicep
// Key Vault permissions module - reusable for different roles and principals
|
|
|
|
@description('Key Vault name')
|
|
param keyVaultName string
|
|
|
|
@description('Principal ID for Key Vault access')
|
|
param principalId string
|
|
|
|
@description('Principal type (User, Group, ServicePrincipal)')
|
|
@allowed(['User', 'Group', 'ServicePrincipal'])
|
|
param principalType string = 'ServicePrincipal'
|
|
|
|
@description('Key Vault role to assign')
|
|
@allowed([
|
|
'Key Vault Administrator'
|
|
'Key Vault Certificates Officer'
|
|
'Key Vault Crypto Officer'
|
|
'Key Vault Crypto Service Encryption User'
|
|
'Key Vault Crypto User'
|
|
'Key Vault Reader'
|
|
'Key Vault Secrets Officer'
|
|
'Key Vault Secrets User'
|
|
])
|
|
param roleName string = 'Key Vault Secrets User'
|
|
|
|
var roleDefinitions = {
|
|
// gitleaks:allow
|
|
'Key Vault Administrator': '00482a5a-887f-4fb3-b363-3b7fe8e74483'
|
|
'Key Vault Certificates Officer': 'a4417e6f-fecd-4de8-b567-7b0420556985'
|
|
'Key Vault Crypto Officer': '14b46e9e-c2b7-41b4-b07b-48a6ebf60603'
|
|
'Key Vault Crypto Service Encryption User': 'e147488a-f6f5-4113-8e2d-b22465e65bf6'
|
|
// gitleaks:allow
|
|
'Key Vault Crypto User': '12338af0-0e69-4776-bea7-57ae8d297424'
|
|
// gitleaks:allow
|
|
'Key Vault Reader': '21090545-7ca7-4776-b22c-e363652d74d2'
|
|
// gitleaks:allow
|
|
'Key Vault Secrets Officer': 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7'
|
|
// gitleaks:allow
|
|
'Key Vault Secrets User': '4633458b-17de-408a-b874-0445c86b69e6'
|
|
}
|
|
|
|
var roleDefinitionId = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions[roleName])
|
|
|
|
resource keyVault 'Microsoft.KeyVault/vaults@2024-11-01' existing = {
|
|
name: keyVaultName
|
|
}
|
|
|
|
resource keyVaultRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
|
|
name: guid(keyVault.id, principalId, roleName)
|
|
scope: keyVault
|
|
properties: {
|
|
roleDefinitionId: roleDefinitionId
|
|
principalId: principalId
|
|
principalType: principalType
|
|
}
|
|
}
|
|
|
|
output roleAssignmentId string = keyVaultRoleAssignment.id
|
|
output roleAssignmentName string = keyVaultRoleAssignment.name
|