'Create a JWT scoped to a specific Azure Key Vault?
I'm using the newer .net Azure.Identity and Azure.Security.KeyVault libraries and I'm wondering if it's possible to create a short lived JWT that is scoped to an explicate Key Vault or even better a specific Key Vault secret?
Normally i would use managed identities, but the in this case the key vault and VM may be in different tenants.
Solution 1:[1]
Being in different tenants shouldn't matter. You could create an Azure App Registration + Client Secret in the KeyVault tenant and then use that to authenticate against Azure AD using an OAuth2 Client Credentials pattern. That will give you a JWT.
You would also need to grant the App Registration/Service Principal the RBAC role necessary against your specific KeyVault (RBAC mode), or do it in the KeyVault policy (policy mode).
There is no way to grant access to specific secrets/keys in KeyVault.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | ForteUnited |