Azure Databricks with Key vault backed secret using RBAC

Chand, Anupam SBOBNG-ITA/RX 451

Azure Key vault had launched the RBAC access model in 2021. This allows finer granular access to a particular secret or key or certificate. The previous model was access policies which doesn't allow this granular access.

From my knowledge, Azure keyvault backed secret scopes on Azure databricks only uses Access policies. This means I cannot give different workspaces access to different secrets on the same Key vault.

Looking at a similar question, the solution was to give keyvault secrets user role, but this would give the workspace access to all the secrets within the key vault.

Can you please confirm that this is still the case and if there is any plan to have ADB be compatible with RBAC keyvaults and provide access at a secret level instead of a Key vault level?

PRADEEPCHEEKATLA-MSFT 76,511 Reputation points Microsoft Employee

2023-05-18T05:11:20.6533333+00:00

@Chand, Anupam SBOBNG-ITA/RX - We are reaching out to the internal team to get more information related to your query and will get back to you as soon as we have an update.
PRADEEPCHEEKATLA-MSFT 76,511 Reputation points Microsoft Employee

2023-05-19T03:42:59.0133333+00:00

@Chand, Anupam SBOBNG-ITA/RX - From which I assume that you would like to leverage RBAC model instead of Access policies to grant different workspaces access to different secrets. If that's not the case, please disregard the following comments.

That is not possible under the same tenant, because you will be authorizing the single enterprise application (called AzureDatabricks), which is then shared by all workspaces.

I believe you can. Make sure you are using Databricks "premium" tier (does not work in standard tier) and set the "manage principal" to "Creator"

Note: Creating an Azure Key Vault-backed secret scope role grants the Get and List permissions to the resource ID for the Azure Databricks service using key vault access policies, even if the key vault is using the Azure RBAC permissions model.

Once this is done, then the creator can create "secrets" and grant access privileges to users/groups for example "reader". Only the user that has been granted permissions can read the secret, other users cannot read the secret.

For more details, refer to Secret scopes.

Hope this helps.
Chand, Anupam SBOBNG-ITA/RX 451 Reputation points

2023-05-19T04:26:54.7566667+00:00

@PRADEEPCHEEKATLA-MSFT Since we are granting databricks access to the resource id which is the entire keyvault, each workspace will have access to all the secrets within that keyvault. We want to segregate access i.e. workspaces should not have access to each others secrets and we would like to do this with 1 keyvault (i.e. utilizing RBAC model).

The below quote clearly states that even if we use RBAC model, the scope will use access policies which means access to all secrets.

Note: Creating an Azure Key Vault-backed secret scope role grants the Get and List permissions to the resource ID for the Azure Databricks service using key vault access policies, even if the key vault is using the Azure RBAC permissions model.
Chand, Anupam SBOBNG-ITA/RX 451 Reputation points

2023-05-19T08:28:58.0766667+00:00

Thanks please put this as the answer so I can accept.

Accepted answer

PRADEEPCHEEKATLA-MSFT 76,511 Reputation points Microsoft Employee

2023-05-19T08:27:12.2866667+00:00

@Chand, Anupam SBOBNG-ITA/RX - Currently, there is no key vault RBAC support for Databricks planned.
Please sign in to rate this answer.
AnnuKumari-MSFT 30,361 Reputation points Microsoft Employee

2023-05-22T15:02:16.7766667+00:00

Hi Chand, Anupam SBOBNG-ITA/RX ,

I have converted the above comment to answer. Kindly accept it by clicking on Accept answer button. Thanks

Tim Sente 0 Reputation points

2023-10-09T07:06:28.97+00:00

Dear,

MS advices to switch Key Vault access towards "Azure role-based access control (recommended)" .

All our customers are asking to migrate from access policies towards RBAC.

Please add support for RBAC authentication for a Key Vault.

thanks in advance!

Rakesh Aggarwal 0 Reputation points

2023-10-25T12:28:45.78+00:00

So, it means only way to access keyvault from Databricks is to use the Access Policies?
Sign in to comment

Azure Databricks with Key vault backed secret using RBAC

0 additional answers