Application gateway listener error when trying to use key vault certificate using managed identity and RBAC

Question

Hi,
I'm trying to setup a listener in application gateway to use a certificate from keyvault using managed identity.
But every time whne I choose in portal the managed identity and then select the key vault from the dropdown menu I get this error:
"This key vault doesn't allow access to the managed identity"

Here is what I set up (all resources are in same resource group "my-rg"):

KeyVault: my-keyvault
Certificate: my-cert
Application gateway: my-appgw
Managed identity: appgw-to-keyvault-managed-identity

Permission model for the KeyVault is set to: "Azure role-based access control"

Once the above resource were created I asigned the managed identity to the application gateway (did this using cli as I haven't found a way to do it in portal):
az network application-gateway identity assign --gateway-name my-appgw --resource-group my-rg --identity appgw-to-keyvault-managed-identity

After that I configured following role assigment for the managed identity "appgw-to-keyvault-managed-identity":

• role "Key Vault Secrets User" for the key vault "my-keyvault"

After this setup I'm getting the above error when trying to choose the kay vault in the application gateway listener setting.

I was trying also following:

• adding "Key Vault Certificates Officer" role for the managed identity towards the key vault
• adding "Contributor" role for the managed identity towards the whole resource group.

None of these helped.

I wasn't able to find any instruction which woudl describe how to set this up for the application gateway.

Can someone let me know if I'm missing something in my setup?

Thanks,
Martin Cangar

Answer 1

I had the exact same problem.

I found that I had to go to 'Access Policies' in Key Vault and change it from 'Azure role-based access control' to 'Vault access policy'. I then created a Vault Access Policy, selected my managed identity as the principal, and granted it the 'Get' and 'List' permissions for both Secrets and Certificates. This allowed me to select the certificate from Application Gateway's 'Add Listener' interface.

Answer 2

Hi,

Just had the same issue. But found a workaround via CLI (az network application-gateway ssl-cert update..., az network application-gateway http-listener update...).
According to [1], the first few steps to reference the Key Vault must be completed via ARM template, Bicep, CLI, or PowerShell.
This might explain why portal says "This key vault doesn't allow access to the managed identity" when attempting to update listener and select a RBAC-managed key vault.
Message should be updated to something like "Access to this key vault is secured by RBAC; please use CLI" or something similar.

Regards,

Olivier

[1] https://learn.microsoft.com/en-us/azure/application-gateway/key-vault-certs#key-vault-azure-role-based-access-control-permission-model

Answer 3

Hi,
at the end thios is how I solved it.

Regards,
Martin Cangar