hashicorp / hashicorp/packer-plugin-azure
Creating Azure Key-Vault using RBAC rather than Vault Access Policy
- Dominant language
- Go
- Stars
- 63
- Forks
- 103
- PR merge metrics
- No merged PRs in 30d
Description
#### Community Note
Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.
#### Description
We have a workflow to build custimized Azure Images for creation of Windows Servers. As per the Azure plugin the packer creates a temporary Key-Vault in Azure with a key and the same is used to login to machine and perform the pre and post provisions and create Image. Once the image is created the temporary key-vault gets deleted.
The issue we are facing currently here is the Key-Vault the packer create uses the Vault access policy but as per our org standards and security we have disabled the vault access policy and we are using the Azure role-based access control as depicted in the image below. We are getting below error.


Perhaps we're missing something obvious, and if so -- maybe someone could point us in the right direction.
Otherwise, having this capability would be incredibly useful, so that we're not having to rely on injecting passwords into the image creation process.
Thanks.
Contributor guide
Research direction
Start by reviewing the Azure plugin's temporary Key Vault creation flow and reproduce the reported failure with vault access policies disabled. Trace how the temporary key and permissions are configured during image creation. Done means the workflow can use Azure RBAC without requiring a vault access policy, while still completing the image build and cleanup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- authorization, cloud, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100