What is missing or needs to be updated?
The Identity and Access Management section of Secrets_Management_Cheat_Sheet.md currently states:
In Azure, having access to the key vault means having access to all secrets in that key vault. It is, thus, essential to have separate key vaults when working on Azure to segregate access.
This is too broad for the current Azure Key Vault authorization model. Microsoft's documentation distinguishes between the legacy Key Vault access-policy model, which assigns permissions at vault scope, and the recommended Azure role-based access control (Azure RBAC) model. Azure RBAC supports role assignments at the vault level and at the scope of individual keys, secrets, and certificates.
The recommendation to use separate vaults should remain, but for a more precise reason. Microsoft recommends separate vaults per application and environment because a vault is the primary security boundary and object-scoped role assignments do not isolate all administrative operations. Individual-object assignments are supported for limited sharing scenarios, not as a general replacement for vault-level isolation.
Official sources reviewed:
How should this be resolved?
Update the paragraph to:
- Recommend the Azure RBAC authorization model and least-privilege vault-level roles.
- Note that Azure RBAC supports individual key, secret, and certificate scopes for limited sharing scenarios.
- Preserve the recommendation for separate vaults per application and environment, explaining that vaults provide the primary security boundary and object-scoped assignments do not isolate all administrative operations.
- Link the claims directly to the relevant Microsoft documentation.
The change should remain a single-paragraph update in one cheat sheet and should not add implementation-specific code.
AI Tool Usage Disclosure
OpenAI Codex (GPT-5) assisted with repository analysis and drafting this proposal. The prompt requested a repository-wide audit for genuine, maintainable OWASP documentation improvements. I opened and reviewed each Microsoft source above and independently verified the current text in the cheat sheet before submitting this issue.
What is missing or needs to be updated?
The Identity and Access Management section of
Secrets_Management_Cheat_Sheet.mdcurrently states:This is too broad for the current Azure Key Vault authorization model. Microsoft's documentation distinguishes between the legacy Key Vault access-policy model, which assigns permissions at vault scope, and the recommended Azure role-based access control (Azure RBAC) model. Azure RBAC supports role assignments at the vault level and at the scope of individual keys, secrets, and certificates.
The recommendation to use separate vaults should remain, but for a more precise reason. Microsoft recommends separate vaults per application and environment because a vault is the primary security boundary and object-scoped role assignments do not isolate all administrative operations. Individual-object assignments are supported for limited sharing scenarios, not as a general replacement for vault-level isolation.
Official sources reviewed:
How should this be resolved?
Update the paragraph to:
The change should remain a single-paragraph update in one cheat sheet and should not add implementation-specific code.
AI Tool Usage Disclosure
OpenAI Codex (GPT-5) assisted with repository analysis and drafting this proposal. The prompt requested a repository-wide audit for genuine, maintainable OWASP documentation improvements. I opened and reviewed each Microsoft source above and independently verified the current text in the cheat sheet before submitting this issue.