How to assign the IAM role for a specific key which created in Azure Key Vault using Azure SDK for GO

Question

How to assign the IAM role for a specific key which created in Azure Key Vault using Azure SDK for GO

Roopan P M 110

We are currently implementing a scenario where we need to assign IAM role for a specific key using Azure SDK for GO.

Can you please let us know which package and methods we can use?

We see rbac package but not able to conclude on that. Please help.

Navya 20,100 Microsoft External Staff Moderator

Hi@Anonymous ,
Thank you for posting this in Microsoft Q&A.

I understand you are asking how to assign an IAM role for a specific key created in Azure Key Vault using Azure SDK for GO.

According to this document need below packages:

1.github.com/Azure/azure-sdk-for-go/sdk/azcore/to
2.github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azadmin/rbac
3.github.com/google/uuid

Use CreateRoleAssignment method from rbac pacakage.

Below is the Sample Code:

package main

import (
	"context"
	"fmt"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azadmin/rbac"
	"github.com/google/uuid"
)

var client rbac.Client

func main() {
	scope := rbac.RoleScopeGlobal
	name := uuid.New().String()
	parameters := rbac.RoleAssignmentCreateParameters{
		Properties: &rbac.RoleAssignmentProperties{
			PrincipalID:      to.Ptr("d26e28bc-991f-11ed-a8fc-0242ac120002"),                                                                      // example principal ID
			RoleDefinitionID: to.Ptr("Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/c368d8da-991f-11ed-a8fc-0242ac120002"), // example role definition ID
		},
	}

	roleAssignment, err := client.CreateRoleAssignment(context.TODO(), scope, name, parameters, nil)
	if err != nil {
		// TODO: handle error
	}

	fmt.Printf("Role Assignment Name: %s", *roleAssignment.Name)
}

Hope this helps. Do let us know if you any further queries.

Thanks,
Navya.

Roopan P M 110 Reputation points

2023-12-11T10:24:58.4933333+00:00
Thanks Navya, But I see only 2 values are there for scope (Global & Keys),

where to provide the specific key id in the request?
Navya 20,100 Reputation points Microsoft External Staff Moderator

2023-12-11T10:47:10.1733333+00:00

Hi@Anonymous
A role assignment has several components, follow the below.

scope-The scope of the role assignment to create.eg:"/keys/myrsakey"
The name - The role assignment to create.
The principalID - userId to assign the role.
RoleDefinitionID - ID of the role.
Roopan P M 110 Reputation points

2023-12-11T10:52:17.4633333+00:00

Thanks Navya for quick response, I will check that.

Also, can you please help for the secrets as well for the similar scenario to assign IAM Role for a specific secret.

I see only Global and Keys under scope constants. Please help
Roopan P M 110 Reputation points

2023-12-11T18:47:44.9266667+00:00

Hi Navya,

The CreateRoleAssignment accepts only scope as predefined constants (RoleScope) and It can be either Global (/) or Keys(/keys) as mentioned below, So please help me providing me an sample request if I misunderstood.
Roopan P M 110 Reputation points

2023-12-12T11:44:07.1033333+00:00

Also, this rbac package is for ManagedHSM. Do we have any other package for Keyvault?

@Navya - Please help
Muhammed Kareem 0 Reputation points

2023-12-12T12:02:39.3533333+00:00
Hi Roopan M

To assign an IAM role for a specific key using Azure SDK for GO, you can use the authorization package and the RoleAssignmentsClient type. Here are the steps to follow:

Import the authorization package from the SDK: import "github.com/Azure/azure-sdk-for-go/services/authorization/mgmt/2023-04-01/authorization"

Create a RoleAssignmentsClient instance with your subscription ID and an authorizer: client := authorization.NewRoleAssignmentsClient(subscriptionID) client.Authorizer = authorizer

Use the Create method to create a role assignment for the key. You need to provide the scope, the role assignment name, and the role assignment parameters: result, err := client.Create(ctx, scope, roleAssignmentName, parameters)

The role assignment parameters include the role definition ID and the principal ID of the key. You can get these values from the Azure portal or the CLI. For example: parameters := authorization.RoleAssignmentCreateParameters{ RoleDefinitionID: to.StringPtr("/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}"), PrincipalID: to.StringPtr("{principalId}"), }

Check the result and the err values for the status of the operation.

For more details, you can refer to the Azure SDK for GO documentation.

Reference: https://learn.microsoft.com/en-us/azure/developer/go/azure-sdk-authentication-service-principal?tabs=azure-cli

hope, this will help you :)
Roopan P M 110 Reputation points

2023-12-14T04:56:57.8933333+00:00

Hi Navya,

Thanks for your solution.

We have used below package and method for achieving the same.

https://beta.pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2#section-readme

We are able to assign IAM role for the specific key with the above function.

Accepted answer

1 additional answer

Your answer

Navya 20,100 Reputation points Microsoft External Staff Moderator

2023-12-11T10:17:17.0966667+00:00

Hi@Anonymous ,
Thank you for posting this in Microsoft Q&A.

I understand you are asking how to assign an IAM role for a specific key created in Azure Key Vault using Azure SDK for GO.

According to this document need below packages:

1.github.com/Azure/azure-sdk-for-go/sdk/azcore/to
2.github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azadmin/rbac
3.github.com/google/uuid

Use CreateRoleAssignment method from rbac pacakage.

Below is the Sample Code:

package main import ( "context" "fmt" "github.com/Azure/azure-sdk-for-go/sdk/azcore/to" "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azadmin/rbac" "github.com/google/uuid" ) var client rbac.Client func main() { scope := rbac.RoleScopeGlobal name := uuid.New().String() parameters := rbac.RoleAssignmentCreateParameters{ Properties: &rbac.RoleAssignmentProperties{ PrincipalID: to.Ptr("d26e28bc-991f-11ed-a8fc-0242ac120002"), // example principal ID RoleDefinitionID: to.Ptr("Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/c368d8da-991f-11ed-a8fc-0242ac120002"), // example role definition ID }, } roleAssignment, err := client.CreateRoleAssignment(context.TODO(), scope, name, parameters, nil) if err != nil { // TODO: handle error } fmt.Printf("Role Assignment Name: %s", *roleAssignment.Name) }

Hope this helps. Do let us know if you any further queries.

Thanks,
Navya.
Roopan P M 110 Reputation points

2023-12-11T10:24:58.4933333+00:00

Thanks Navya, But I see only 2 values are there for scope (Global & Keys),

where to provide the specific key id in the request?
Navya 20,100 Reputation points Microsoft External Staff Moderator

2023-12-11T10:47:10.1733333+00:00

Hi@Anonymous
A role assignment has several components, follow the below.

scope-The scope of the role assignment to create.eg:"/keys/myrsakey"
The name - The role assignment to create.
The principalID - userId to assign the role.
RoleDefinitionID - ID of the role.
Roopan P M 110 Reputation points

2023-12-11T10:52:17.4633333+00:00

Thanks Navya for quick response, I will check that.

Also, can you please help for the secrets as well for the similar scenario to assign IAM Role for a specific secret.

I see only Global and Keys under scope constants. Please help
Roopan P M 110 Reputation points

2023-12-11T18:47:44.9266667+00:00

Hi Navya,

The CreateRoleAssignment accepts only scope as predefined constants (RoleScope) and It can be either Global (/) or Keys(/keys) as mentioned below, So please help me providing me an sample request if I misunderstood.
Roopan P M 110 Reputation points

2023-12-12T11:44:07.1033333+00:00

Also, this rbac package is for ManagedHSM. Do we have any other package for Keyvault?

@Navya - Please help
Muhammed Kareem 0 Reputation points

2023-12-12T12:02:39.3533333+00:00

Hi Roopan M

To assign an IAM role for a specific key using Azure SDK for GO, you can use the authorization package and the RoleAssignmentsClient type. Here are the steps to follow:

Import the authorization package from the SDK: import "github.com/Azure/azure-sdk-for-go/services/authorization/mgmt/2023-04-01/authorization"

Create a RoleAssignmentsClient instance with your subscription ID and an authorizer: client := authorization.NewRoleAssignmentsClient(subscriptionID) client.Authorizer = authorizer

Use the Create method to create a role assignment for the key. You need to provide the scope, the role assignment name, and the role assignment parameters: result, err := client.Create(ctx, scope, roleAssignmentName, parameters)

The role assignment parameters include the role definition ID and the principal ID of the key. You can get these values from the Azure portal or the CLI. For example: parameters := authorization.RoleAssignmentCreateParameters{ RoleDefinitionID: to.StringPtr("/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}"), PrincipalID: to.StringPtr("{principalId}"), }

Check the result and the err values for the status of the operation.

For more details, you can refer to the Azure SDK for GO documentation.

Reference: https://learn.microsoft.com/en-us/azure/developer/go/azure-sdk-authentication-service-principal?tabs=azure-cli

hope, this will help you :)
Roopan P M 110 Reputation points

2023-12-14T04:56:57.8933333+00:00

Hi Navya,

Thanks for your solution.

We have used below package and method for achieving the same.

https://beta.pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2#section-readme

We are able to assign IAM role for the specific key with the above function.

Answer 1

Hi@Anonymous

I'm glad that your issue is resolved and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others Opens in new window or tab", I'll repost your solution in case you'd like to "Accept Opens in new window or tab" the answer.

issue:

How to assign the IAM role for a specific key which created in Azure Key Vault using Azure SDK for GO.

solution:

Used below package and method for achieving the scenario.
https://beta.pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2#section-readme

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

I hope this helps!

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.

Thanks,
Navya.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Roopan P M 110

Hi Navya,

Thanks for your solution.

We have used below package and method for achieving the same.

https://beta.pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2#section-readme

User's image

We are able to assign IAM role for the specific key with the above function.

Share via

How to assign the IAM role for a specific key which created in Azure Key Vault using Azure SDK for GO

1 additional answer

Your answer