az keyvault role definition

Manage role definitions.

Commands

az keyvault role definition create

Create a custom role definition.

az keyvault role definition delete

Delete a role definition.

az keyvault role definition list

List role definitions.

az keyvault role definition show

Show the details of a role definition.

az keyvault role definition update

Update a role definition.

az keyvault role definition create

Create a custom role definition.

az keyvault role definition create --hsm-name
                                   --role-definition
                                   [--subscription]

Examples

Create a role by a JSON string.

az keyvault role definition create --hsm-name MyHSM --role-definition '{
    "roleName": "My Custom Role",
    "description": "The description of the custom rule.",
    "actions": [],
    "notActions": [],
    "dataActions": [
        "Microsoft.KeyVault/managedHsm/keys/read/action"
    ],
    "notDataActions": []
}'

Create a role from a file containing a JSON description.

az keyvault role definition create --hsm-name MyHSM --role-definition @keyvault-role.json

Required Parameters

--hsm-name

Name of the HSM.

--role-definition

Description of a role as JSON, or a path to a file containing a JSON description.

Optional Parameters

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault role definition delete

Delete a role definition.

az keyvault role definition delete --hsm-name
                                   [--name]
                                   [--role-id]
                                   [--subscription]

Required Parameters

--hsm-name

Name of the HSM.

Optional Parameters

--name -n

The role definition name. This is a GUID in the "name" property of a role definition.

--role-id

The role definition ID.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault role definition list

List role definitions.

az keyvault role definition list [--custom-role-only {false, true}]
                                 [--hsm-name]
                                 [--query-examples]
                                 [--scope]
                                 [--subscription]

Optional Parameters

--custom-role-only

Only show custom role definitions.

accepted values: false, true
--hsm-name

Name of the HSM.

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--scope

Scope at which the role assignment or definition applies to, e.g., "/" or "/keys" or "/keys/{keyname}".

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault role definition show

Show the details of a role definition.

az keyvault role definition show --hsm-name
                                 [--name]
                                 [--query-examples]
                                 [--role-id]
                                 [--subscription]

Required Parameters

--hsm-name

Name of the HSM.

Optional Parameters

--name -n

The role definition name. This is a GUID in the "name" property of a role definition.

--query-examples

Recommend JMESPath string for you. You can copy one of the query and paste it after --query parameter within double quotation marks to see the results. You can add one or more positional keywords so that we can give suggestions based on these key words.

--role-id

The role definition ID.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

az keyvault role definition update

Update a role definition.

az keyvault role definition update --hsm-name
                                   --role-definition
                                   [--subscription]

Examples

Update a role by a JSON string.

az keyvault role definition update --hsm-name MyHSM --role-definition '{
    "roleName": "My Custom Role",
    "name": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "id": "Microsoft.KeyVault/providers/Microsoft.Authorization/roleDefinitions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "description": "The description of the custom rule.",
    "actions": [],
    "notActions": [],
    "dataActions": [
        "Microsoft.KeyVault/managedHsm/keys/read/action",
        "Microsoft.KeyVault/managedHsm/keys/write/action",
        "Microsoft.KeyVault/managedHsm/keys/backup/action",
        "Microsoft.KeyVault/managedHsm/keys/create"
    ],
    "notDataActions": []
}'

Update a role from a file containing a JSON description.

az keyvault role definition update --hsm-name MyHSM --role-definition @keyvault-role.json

Required Parameters

--hsm-name

Name of the HSM.

--role-definition

Description of a role as JSON, or a path to a file containing a JSON description.

Optional Parameters

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.