hashicorp / hashicorp/packer-plugin-azure

Creating Azure Key-Vault using RBAC rather than Vault Access Policy

Open
#499 3 comments 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
63
Forks
103
PR merge metrics
No merged PRs in 30d

Description

#### Community Note

Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.

#### Description

We have a workflow to build custimized Azure Images for creation of Windows Servers. As per the Azure plugin the packer creates a temporary Key-Vault in Azure with a key and the same is used to login to machine and perform the pre and post provisions and create Image. Once the image is created the temporary key-vault gets deleted.

The issue we are facing currently here is the Key-Vault the packer create uses the Vault access policy but as per our org standards and security we have disabled the vault access policy and we are using the Azure role-based access control as depicted in the image below. We are getting below error.

![Image](https://github.com/user-attachments/assets/cd27c064-99d2-4f38-9946-4879a526c6ce)

![Image](https://github.com/user-attachments/assets/a241839c-6b75-44c7-8dff-e19b3528285a)

Perhaps we're missing something obvious, and if so -- maybe someone could point us in the right direction.
Otherwise, having this capability would be incredibly useful, so that we're not having to rely on injecting passwords into the image creation process.

Thanks.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the Azure plugin's temporary Key Vault creation flow and reproduce the reported failure with vault access policies disabled. Trace how the temporary key and permissions are configured during image creation. Done means the workflow can use Azure RBAC without requiring a vault access policy, while still completing the image build and cleanup.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
authorization, cloud, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.