Create a least-privilege role
Build a role with only the permissions a job needs.
As pki-admin
Open /roles
Click New role
Fill Role name with "cert-reader"
Fill Description with "Read-only access to certificates and reports"
Tick certificate.read
Tick report.read
Tick audit.read
Click Create role
Click New role
Fill Role name with "cert-reader"
Tick certificate.read
Creating a role with a name that already exists shows an error
