You must set permissions for the BYOK service by configuring each Azure Key Vault that you want to manage.

Azure Key Vault now offers Azure role-based access control (Azure RBAC) in addition to the previous access policy model. If you are upgrading from a previous Cryptographic Security Platform Vault release, you will have used the access policy model.

Setting permissions for the Azure RBAC permission model

Repeat the following steps for each key vault that uses the Azure RBAC permission model.

To set permissions for the Azure RBAC permission model

  1. Navigate to Azure > Key vaults > <Key Vault name> > Access control (IAM).

  2. Click Add role assignment to assign the Key Vault Crypto Officer role to the BYOK application.

  3. In Job function roles, select Key Vault Crypto Officer and then click Next.

  4. Click + Select Members.

  5. Search for the BYOK application and click the + next to it, then click Select.

  6. Click Review + assign to move to the final step of Add role assignment.

  7. Review the settings and then click Review + assign.

Setting permissions for Vault Access Policies

Repeat the following steps for each Key Vault that uses Vault Access Policies.

To set permissions for Vault Access Policies

  1. Navigate to Azure > Key vaults > <Key Vault name> > Access control (IAM).
  2. Use Add Access Policy to add permissions to the BYOK application.
  3. In the Key Permissions column, click Select All for both the Key Management Operations and Privileged Key Operations lists of permissions.
  4. Select Principal > BYOK application.
  5. Select Add.