azure - Set-AzKeyVaultAccessPolicy overwrote another objects policy instead of adding - Stack Overflow

admin管理员组

文章数量:1405731

We have an azure pipeline that adds get permissions to a keyvault using powershell.

Set-AzKeyVaultAccessPolicy -ResourceGroupName $MyResourceGroupName -VaultName $MyKeyVaultName -ObjectId $MyObjectId -PermissionsToSecrets get

It runs several times for several objects giving them permissions.

Today on one of the runs I noticed that one object was missing permissions in the keyvault. Looking in the activity log I noticed that instead of adding a new chunk in the policy for the new object, it had suddenly changed the objectid of another existing object in the policy. This caused one object to lose its permissions.

Is this an azure bug or an expected behaviour? Do I need to be explicit about something when using Set-AzKeyVaultAccessPolicy to ensure that I keep the existing policy for the other objects?

Note that this only happened for one of the executions, all the other objects got their permissions added normally.

We have an azure pipeline that adds get permissions to a keyvault using powershell.

Set-AzKeyVaultAccessPolicy -ResourceGroupName $MyResourceGroupName -VaultName $MyKeyVaultName -ObjectId $MyObjectId -PermissionsToSecrets get

It runs several times for several objects giving them permissions.

Today on one of the runs I noticed that one object was missing permissions in the keyvault. Looking in the activity log I noticed that instead of adding a new chunk in the policy for the new object, it had suddenly changed the objectid of another existing object in the policy. This caused one object to lose its permissions.

Is this an azure bug or an expected behaviour? Do I need to be explicit about something when using Set-AzKeyVaultAccessPolicy to ensure that I keep the existing policy for the other objects?

Note that this only happened for one of the executions, all the other objects got their permissions added normally.

• azure
• azure-powershell
• azure-keyvault

Share Follow asked Mar 7 at 13:09 BubBub 10411 silver badge77 bronze badges

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

Few of my observations:

Using -PassThru parameter:

$keyVault = Set-AzKeyVaultAccessPolicy -ResourceGroupName $MyResourceGroupName -VaultName $MyKeyVaultName -ObjectId $MyObjectId -PermissionsToSecrets get -PassThru

Kindly retrieve the existing policies first:

$keyVault = Get-AzKeyVault -ResourceGroupName $MyResourceGroupName -VaultName $MyKeyVaultName
$existingPolicies = $keyVault.AccessPolicies
$newPolicy = New-Object -TypeName Microsoft.Azure.Commands.KeyVault.Models.PSKeyVaultAccessPolicyEntry -ArgumentList $MyObjectId, @('get')
$updatedPolicies = $existingPolicies + $newPolicy
Set-AzKeyVaultAccessPolicy -ResourceGroupName $MyResourceGroupName -VaultName $MyKeyVaultName -AccessPolicies $updatedPolicies

Updating the module:

Update-Module -Name Az

Alternatively, you still can use CLI:

az keyvault set-policy

Hope it helps

本文标签： azureSetAzKeyVaultAccessPolicy overwrote another objects policy instead of addingStack Overflow