Managed identity for encrypting Azure Database for PostgreSQL Flexible Server

If you are using Azure Database for PostgreSQL Flexible Server with Cloudera, you can optionally use the CMK used for encrypting VM disks to encrypt the Azure Flexible Server database instance used by Cloudera.

In addition to the CMEK-related permissions described earlier, you should create a managed identity in Azure and assign to it an appropriate role with permissions that allow accessing the target key vault of the CMEK for cryptographic operations needed for storage encryption using that CMEK. In particular, the following dataActions shall be granted to the role:

"dataActions": [
"Microsoft.KeyVault/vaults/keys/read",
"Microsoft.KeyVault/vaults/keys/wrap/action",
"Microsoft.KeyVault/vaults/keys/unwrap/action"
],

There are two options:

Using a built-in role provided by Azure:

Key Vault Crypto Service Encryption User contains the bare minimum set of cryptographic permissions, although the Microsoft.EventGrid/* permissions are actually not needed. Alternatively, Key Vault Crypto User is also satisfactory, although it grants too many extra permissions on top of the ones that are strictly required.
Using a custom role:

Cloudera suggests cloning the Key Vault Crypto Service Encryption User and possibly removing the Microsoft.EventGrid/* permissions, which are not needed. All the DataActions for Microsoft.KeyVault/* specified in this role are needed.

In either of the two cases, the role assignment of the managed identity should be scoped at the target Key Vault of the CMEK.