Using Service Principal for Azure Key Vault RBAC for Column Master Key

Question

Hi Team,

I am using Service Principal as database contained user in Azure SQL database. I have a column master key in Azure Key Vault (RBAC) for which I have given the Key Vault Crypto User role to the same service principal as db contained user.
At .net side I am using Entity framework core where AccessToken for db connection is obtained by using ClientSecretCredential (Azure.Identity).
How to get column master key from key vault using this role based access for the service principal? Can I use same token?

Answer 1

@VD , Thanks for reaching out.

An AccessToken must be obtained with appropriate audience as shown below in scope for Key Vault:

scope : https://vault.azure.net/.default

An easy way to check if the same AccessToken can be used, go to https://jwt.ms/ and decode token which obtained for DB connection and verify token was acquired for vault.azure.net audience as shown below, if not then obtain a new token by using ClientSecretCredential (Azure.Identity).

------------------------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.