Create Azure Key Vault credentials with the following permissions.
Scope | Permission | Description |
|---|---|---|
Certificate | get | Required to retrieve certificate details and PEM-encoded certificate bodies. Without this permission, the plugin can list certificates but cannot retrieve their data. |
list | Required to enumerate all certificates in the vault. Without this permission, the plugin cannot discover certificates. | |
Key | get | Required to retrieve key details and public key data for asymmetric keys. Without this permission, the plugin can list keys but cannot retrieve public keys or metadata. |
list | Required to enumerate all keys in the vault. Without this permission, the plugin cannot discover keys. | |
Secret | get | Optional. get returns the secret value. The plugin reads the value only in memory to sub-classify PEM-encoded keys and never exports it. Not required for standard discovery — secret metadata is provided by list. |
list | Required to discover secrets and retrieve their metadata. Sufficient on its own for secret discovery; secret values are not needed. |
Note:
Recommended (Azure RBAC, least privilege): Assign the service principal the Key Vault Reader role on the vault, plus Reader on the subscription. This is sufficient to discover certificates, keys, and secrets (metadata plus public certificate/key bodies) and cannot read secret values or private key material. The get/list permissions in the table above apply to the legacy Access Policy model; in that model, secret get is optional and only needed to sub-classify PEM keys stored in secret values.
The following credential creation modes are supported: