[CLI/PS] KeyVault -Remove client-side RBAC assignment creation logic for Key Vault and rely on service API behavior
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
**Background**
Currently, Azure CLI and Azure PowerShell implement custom client-side logic to handle Key Vault RBAC authorization during Key Vault creation. This logic predates the service API support and was introduced to provide a consistent RBAC experience for users.
The Key Vault service API now natively supports RBAC authorization configuration as part of the resource creation workflow. Maintaining client-side logic creates duplicate behavior, increases maintenance cost, and introduces the risk of divergence between client tools and service implementation.
**Problem Statement**
Azure CLI and Azure PowerShell currently override or supplement Key Vault RBAC configuration through client-side implementation.
Remove the client-side RBAC assignment/configuration logic from Azure CLI and Azure PowerShell.
**Instead:**
Pass user-specified parameters directly to the Key Vault service API.
Rely on the service-defined API contract and behavior for RBAC configuration.
Eliminate any client-specific RBAC handling that duplicates service functionality.
Ensure client tools remain aligned with the latest Key Vault API implementation.
Contributor guide
Assessment
This issue has not been assessed yet.