Search for a command to run...
Hi there, I'm a prior hybrid network engineer transformed cloud engineer, and I enjoy writing posts about my technical journey including implementation guides, insights, tips, scripts and graphics from what I've gleaned along the way.
Thanks for this - never really thought about the difference between the methods. Just sort of "winged" it.
Granularity is (almost always) a good thing! RBAC it is!
Thank you Jake, glad you liked it! And I absolutely agree with you - RBAC all day every day :)
Choosing which Azure load balancer to place in front of your cloud application is an important decision as its functionality can have an impact on user experience, reliability, and security. While there are 90+ 3rd-party LB options available (i.e. F5...
Overview Finding the balance between ensuring the security of user identities while providing a self-service user experience takes continuous effort. With the constantly evolving cloud landscape and the security around it, IAM user administration can...
Overview Managing a global fleet of virtual machines (VMs) across various cloud service providers (CSPs) can be a challenging task. Depending on the naming convention applied to your hostnames, quickly identifying the CSP and region for a VM could be...
Overview 🔎 Quickly find AWS S3 Objects inside buckets hosting huge volumes of files using my latest Boto3 script! You can easily locate specific objects in your AWS profile by providing a few command line arguments. By specifying the AWS profile, bu...
Overview Perform checkouts against your AWS Kubernetes cluster before and after implementing changes such as upgrades by using my latest Bash shell script! I took my AKS checkouts script from a couple of weeks ago and converted it into an EKS checkou...
Overview Capture a list of available AWS AMIs for a specified region and OS version with my latest boto3 script. This Python script will output a color-coded table listing AMIs that have been released within the last 30 days with the owner alias set ...
Applying the RBAC permission model to protect 🔐 your Azure Key Vault objects should be used in favor of the access policy option.
The vault access policy is applied at the Key Vault scope. Meaning if you had a dozen secrets in your vault, then you're essentially allowing everyone privileges in the policy access to all of those secrets. A workaround to this is to create a separate key vault for each key vault object, applying a policy on each vault. This creates config and permissions management overhead 😣
Alternatively, if you use the RBAC model, then there's no need for a policy. The majority of RBAC roles are applied at either the control or management planes in Azure. However, there are several data plane built-in roles available for the key vault such as the "Key Vault Crypto User" which allows the 'list' of keys 🔑 or the "Key Vault Secrets User" allowing you to 'get' and 'list' secrets. These RBAC controls can be applied at the entire vault scope or on a per-vault object basis thus securing access to each of your keys/secrets/certificates within the vault. This allows for much more granular permissions, decreases config overhead and provides a higher level of protection for your ☁️ assets.
Do you agree? What authorization method works best for you? I'd love to hear your opinion about this. Let me know in the comments!
