Azure / Azure/azure-cli

[CLI/PS] KeyVault -Remove client-side RBAC assignment creation logic for Key Vault and rely on service API behavior

Open
#33,913 2 comments 0 reactions 1 assignee Claimed by @notyashhh View on GitHub
act-identity-squad feature-request KeyVault
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Background**

Currently, Azure CLI and Azure PowerShell implement custom client-side logic to handle Key Vault RBAC authorization during Key Vault creation. This logic predates the service API support and was introduced to provide a consistent RBAC experience for users.

The Key Vault service API now natively supports RBAC authorization configuration as part of the resource creation workflow. Maintaining client-side logic creates duplicate behavior, increases maintenance cost, and introduces the risk of divergence between client tools and service implementation.

**Problem Statement**

Azure CLI and Azure PowerShell currently override or supplement Key Vault RBAC configuration through client-side implementation.

Remove the client-side RBAC assignment/configuration logic from Azure CLI and Azure PowerShell.

**Instead:**

Pass user-specified parameters directly to the Key Vault service API.
Rely on the service-defined API contract and behavior for RBAC configuration.
Eliminate any client-specific RBAC handling that duplicates service functionality.
Ensure client tools remain aligned with the latest Key Vault API implementation.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.