Azure Key Vault RBAC Atlas
Parent: MongoDB Atlas on Azure · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-3e9502b80e34
↓ Facts as markdownall context files
Source-anchored research for Azure Key Vault RBAC Atlas. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- Atlas documents M10 or larger as the prerequisite for its Azure Key Vault secretless integration and excludes Free and Flex deployments. Inference for cost planning: an Azure key-access requirement can establish a paid cluster floor even when workload capacity would fit below it. (medium confidence) (verified as of 2026-10-14) [source]
- When migrating an Atlas project to secretless authentication over private networking, acceptance of the configuration PATCH does not complete validation: data nodes validate access asynchronously. MongoDB warns that incorrect permissions can eventually disrupt operations and shut down the cluster. (low confidence) (verified as of 2026-10-14) [source]
- HashiCorp warns that managing the same Key Vault access policies both inline in azurerm_key_vault and through separate azurerm_key_vault_access_policy resources causes conflicts. Atlas infrastructure code using access policies should choose one ownership mechanism. (low confidence) [source]
Comparisons and alternatives
- Atlas secretless authentication authorizes an Atlas-managed Azure service principal and uses short-lived OAuth tokens instead of stored customer client secrets. Atlas continues to support a static-credential method alongside this option. (medium confidence) (verified as of 2026-10-14) [source]
Facts and statements
- For Atlas secretless RBAC setup, MongoDB specifies Reader for vault metadata plus Key Vault Crypto User or an equivalent custom role. Microsoft distinguishes management-plane access from key operations; Key Vault Reader alone provides metadata access. (high confidence) (verified as of 2026-10-14) [source]
- Atlas secretless authentication uses an Atlas-managed Azure service principal and short-lived OAuth tokens. Registration through Cloud Provider Access returns a roleId used in the project encryption configuration, replacing stored static credentials. (low confidence) (verified as of 2026-10-14) [source]
- Azure RBAC and Key Vault access policies are alternative data-plane permission models for Atlas. Enabling RBAC invalidates existing access-policy permissions, so equivalent RBAC assignments must exist before a migration to avoid outages. (high confidence) (verified as of 2026-10-14) [source]
- Key Vault Contributor does not itself grant data-plane key access. Atlas instead documents cryptographic permissions including get, encrypt and decrypt; adding only a management role is insufficient. (high confidence) (verified as of 2026-10-14) [source]
- Historical Atlas users reported generic Azure credential or connection errors despite apparently correct credentials. A 2022 Stack Overflow answerer reports that assigning Key Vault Reader at the vault let their Atlas settings save; a separate November 10, 2021 comment on the thread says Reader was insufficient for that setup and a higher vault role at subscription scope worked. These anecdotes justify checking role assignment scope, but do not prove a universal fix or a current defect. (medium confidence) [source]
- Atlas states that revoking its customer-key access shuts down cluster nodes until access is restored. Its secretless migration guide also warns that private-network validation is asynchronous and a successful PATCH acceptance does not establish successful data-node validation. (high confidence) (verified as of 2026-10-14) [source]
- Atlas requires get, encrypt, and decrypt permissions on its Key Vault key. Key Vault Reader alone provides metadata access, while Key Vault Crypto User permits cryptographic operations; a custom role can provide equivalent required permissions. (high confidence) [source]
- Key Vault Contributor does not itself grant key, secret, or certificate data-plane access. It is therefore insufficient by itself for the key operations Atlas requires. (high confidence) [source]
- Role changes need propagation time: Microsoft advises allowing several minutes for assignments to refresh. Validate the effective identity, permission model, scope, and required key operations before concluding that a newly assigned role has failed. (medium confidence) [source]
Children
- No children recorded.