What is the purpose of Key Vault Contributor role?

Question

I am confused by the Key Vault Contributor role. Even though it has write permission for secret, it does not allow me to create a new secret. I see this in permissions json: Microsoft.KeyVault/vaults/secrets/write. Then why it is not allowing me to create new secrets?

And I am not able to understand this from Microsoft Docs:

The Key Vault Contributor role is for management plane operations only to manage key vaults.

When they say management plane operations, what does it mean?

Answer 1

Hi @Govindarajan D

Thank you for posting your query on Microsoft Q&A.

The Key Vault Contributor role is designed for admins who will manage Key Vaults in the Azure Portal. But it is not intended for use by Applications which will access keys / secrets. This is what is being referred to as "Management pane operations"

To access the keys / secrets you would need a role which has Data Pane operations.

If you compare the roles you will see there are both "Actions" and "Data Actions", where the "Key Vault Contributor" has no data actions - https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor

But if we look at a role such as "Key Vault Crypto Officer" it has "Data Actions" - https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-crypto-officer

Let me know if you have any further queries, I would be happy to help.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.