How to enable key vault permission for disk encryption set using Azure Python SDK API calls?

Question

I am setting up disk encryption using a key vault, but I'm unable to grant permission to the key vault after creating the Disk Encryption Set (DES). The overview section of the DES shows a warning that reads: "To associate a disk, image, or snapshot with this disk encryption set, you must grant permissions to the key vault 'vaultxyz'." I need to grant access to the key vault using Python SDK API calls. Can someone please provide guidance on how to achieve this? Thanks!

Answer 1

@Prem Jha

Thank you for your post and I apologize for the delayed response!

To grant permissions to the Key Vault for your Disk Encryption Set using the Python SDK, you should be able to leverage the azure.mgmt.keyvault package. For more info - Key Vault Resource Management.

When setting up your disk encryption set using CLI, you'll notice that you need to assign the following Key permissions - wrapkey, unwrapkey, get.

• CLI - Grant the DiskEncryptionSet resource access to the key vault:

az keyvault set-policy -n $keyVaultName \
-g $rgName \
--object-id $desIdentity \
--key-permissions wrapkey unwrapkey get

To grant access policy permissions through the Azure SDK for Python, you can reference the code snippet to hopefully help point you in the right direction. For more info.

def main():
    client = KeyVaultManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="00000000-0000-0000-0000-000000000000",
    )

    response = client.vaults.update_access_policy(
        resource_group_name="sample-group",
        vault_name="sample-vault",
        operation_kind="add",
        parameters={
            "properties": {
                "accessPolicies": [
                    {
                        "objectId": "00000000-0000-0000-0000-000000000000",
                        "permissions": {"certificates": ["get"], "keys": ["encrypt"], "secrets": ["get"]},
                        "tenantId": "00000000-0000-0000-0000-000000000000",
                    }
                ]
            }
        },
    )

---

Links:

• Use the Azure CLI to enable server-side encryption with customer-managed keys for managed disks
• update_access_policies_add.py

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.