from pulumi_azure import ( msi, role )

        assignment_name = "{}-asgn".format(vault['id'])
        vault_assignment = role.Assignment(assignment_name,
            name=assignment_name,
            principal_id=uai.principal_id,
            role_definition_name="Reader",
            scope=SUBSCRIPTION_PRE.format(
                vars.subscription_id,
                resource_group_name,
                'Microsoft.KeyVault',
                'vaults',
                vault_name
            )
        )