[QUERY] How to add new access policy to key vault without deleting all existing access policies?

[trygvelo]

Library name and version

Azure.ResourceManager.KeyVault 1.2.0

Query/Question

As the title says, how do I add new access policy to key vault without deleting all existing access policies in the vault?

According to this bug report, it should be possible, but I just cannot figure out how: #32872

This sample doesn't give any answers either. https://github.com/Azure-Samples/azure-samples-net-management/blob/master/samples/keyvault/manage-key-vault/Program.cs. If I modify the sample to update access policy for a new principal id, the existing access policy is deleted

Environment

No response

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[trygvelo]

I tried the following code in an attempt to iterate over all existing access policies to add those to the update patch:

var patch = new KeyVaultPatch();
patch.Properties = new KeyVaultPatchProperties();
var existingPolicies = keyVault.GetPolicyAssignments();
foreach (var policy in existingPolicies)
    patch.Properties.AccessPolicies.Add(new KeyVaultAccessPolicy(tenantId, policy.Data.ManagedIdentity.PrincipalId.Value.ToString(), permissions));
patch.Properties.AccessPolicies.Add(new KeyVaultAccessPolicy(tenantId, principalId1, permissions));
var UpdateKeyVault = await keyVault.UpdateAsync(patch);

But existingPolicies does not contain any elements :(

[cxznmhdcxz]

Hi @trygvelo you could try this code. Let's say there's already an instance keyVault :

IdentityAccessPermissions accessPermissions = new IdentityAccessPermissions()
{
    Secrets =
    {
        IdentityAccessSecretPermission.All
    }
};
KeyVaultAccessPolicy accessPolicy = new KeyVaultAccessPolicy(tenantId, ObjectId, accessPermissions);
var accessPolicies = new List<KeyVaultAccessPolicy>() { accessPolicy };
var updateProperties = new KeyVaultAccessPolicyProperties(accessPolicies);
var updateParameters = new KeyVaultAccessPolicyParameters(updateProperties); 
keyVault.UpdateAccessPolicy(AccessPolicyUpdateKind.Add, updateParameters);

The ObjectId could be either a user account or a managed identity.

[trygvelo]

Hi @cxznmhdcxz

Thanks, that works exactly as expected!

Hi @trygvelo you could try this code. Let's say there's already an instance keyVault :

IdentityAccessPermissions accessPermissions = new IdentityAccessPermissions()
{
    Secrets =
    {
        IdentityAccessSecretPermission.All
    }
};
KeyVaultAccessPolicy accessPolicy = new KeyVaultAccessPolicy(tenantId, ObjectId, accessPermissions);
var accessPolicies = new List<KeyVaultAccessPolicy>() { accessPolicy };
var updateProperties = new KeyVaultAccessPolicyProperties(accessPolicies);
var updateParameters = new KeyVaultAccessPolicyParameters(updateProperties); 
keyVault.UpdateAccessPolicy(AccessPolicyUpdateKind.Add, updateParameters);

The ObjectId could be either a user account or a managed identity.

Note to self: Make sure to "refresh" the keyVault instance after adding access policy to see the added access policy in the keyVault instance.