resource accessPoliciesForSystemAssignedIdentity 'Microsoft.KeyVault/vaults/accessPolicies@2023-07-01' = {
  name: 'add'
  parent: domainCertificateKeyvault
  properties: {
    accessPolicies: [
      {
        objectId: apimgmtPrincipleId
        permissions: {
          secrets: [
            'list', 'get'
          ]
        }
        tenantId: 'xx-xx-xx...'
      }
    ]
  }
}