Answers: <p>Check your Key-vault permission model under your Key Vault -&gt; Settings -&gt; Access Configuration on Azure portal.</p>
  <p>Azure keyvault mainly allows key vault access using two permission models.</p>
  <p>Azure role-based access control
  Vault access policy</p>
  <p>If you are using Azure role-based access control, make sure that you have given 'Key Vault Administrator' role to your service principal from Access Control (IAM) section of your key vault.</p>
  <p>Refer: <a href="https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli</a></p>
  <p>If you are using Vault access policy, make sure that you have added policy for your service principal with necessary permissions under Access Policies section of your key vault.</p>
  <p>You could also use:
  Set-AzKeyVaultAccessPolicy -VaultName &quot;&quot; -UserPrincipalName &quot;user@domain.com&quot; -PermissionsToSecrets delete,get,list,set</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-09-01T08:03:24.543Z
Answers: Thanks - I did say on my post that I can't find the right role - which I thought suggests we're using RBAC. Anyway - resolved it, I was using the totally wrong TF resource
Answers: Stuart.Sklinar
Answers: CC BY-SA 4.0
Answers: 2023-08-31T15:53:36.690Z
Answers: 2023-08-31T16:02:35.363Z
Answers: 2023-08-31T16:02:35.363Z
Answers: geeky_girl
Body: <p>Trying to amend an existing storage account to add Customer-Managed-Key Rotation to it, using key vault, as per the docs from Terraform and MS.</p>
  <p>Looks like we've done everything right, but we're just getting permissions errors, and not even setting admin seems to resolve it.</p>
  <p>Now if we were using access policies, which all the docs do, I suspect it would be fine, but I can't find any roles that explicitly say <code>Microsoft.KeyVault/vaults/storageaccounts/read</code> (<code>They do say Microsoft.KeyVault/vaults/*/read though</code>).</p>
  <p>Given it looks like its' trying to access storage, I also granted my SPN access to that (Even though it already had contrib - but no dice).</p>
  <p>The specific url failing is:</p>
  <p><a href="https://kmykv.vault.azure.net/storage/mystorageaccount?api-version=7.4" rel="nofollow noreferrer">https://kmykv.vault.azure.net/storage/mystorageaccount?api-version=7.4</a>:</p>
  <pre><code>Checking for presence of existing Managed Sctorage Account &quot;mystorageaccoutn&quot; (Key Vault &quot;Key Vault (Subscription: \&quot;a3141da1-06b2-4cae-8032-0000000\&quot;\nResource Group Name: \&quot;myrg\&quot;\nKey Vault Name: \&quot;myvault\&quot;)&quot;): keyvault.BaseClient#GetStorageAccount: Failure responding to request: StatusCode=403 
  
  -- Original Error: autorest/azure: Service returned an error. Status=403 Code=&quot;Forbidden&quot; Message=&quot;Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.
  
  \r\nCaller: appid=000000-00-4913-8a44-f6d8112355b0;oid=000000-ed7f-42d0-8f41-0000;iss=https://sts.windows.net/00000-1057-4117-ac28-80cdfe86f8c3/\r\nAction: 'Microsoft.KeyVault/vaults/storageaccounts/read'\r\nResource: '/subscriptions/00000-06b2-4cae-8032-0000/resourcegroups/myrg/providers/microsoft.keyvault/vaults/myvault'\r\nAssignment: (not found)\r\nDecisionReason: 'DeniedWithNoValidRBAC' \r\nVault: myvault;location=uksouth\r\n&quot; InnerError={&quot;code&quot;:&quot;ForbiddenByRbac&quot;}
  </code></pre>
  <p>Terraform</p>
  <pre><code>data &quot;azurerm_client_config&quot; &quot;current&quot; {}
  
  data &quot;azuread_service_principal&quot; &quot;keyvaultspn&quot; {
    #This is the SPN for KeyVault defined across AZ - https://learn.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys
    # display_name = &quot;Azure Key Vault&quot;
    application_id = &quot;cfa8b339-82a2-471a-a3c9-0fc0be7a4093&quot;
  }
  
  
  resource &quot;azurerm_storage_account&quot; &quot;this&quot; {
    name                              = &quot;mystorageaccount&quot;
    location                          = &quot;uksouth&quot;
    resource_group_name               = &quot;myrg&quot;
    
    identity {
      type = &quot;SystemAssigned&quot;
    }
  }
  
  resource &quot;azurerm_role_assignment&quot; &quot;kvstoragerole&quot; {
    scope                = azurerm_storage_account.this.id
    role_definition_name = &quot;Storage Account Key Operator Service Role&quot;
    principal_id         = data.azuread_service_principal.keyvaultspn.id
  }
  
  resource &quot;azurerm_role_assignment&quot; &quot;storagekvrole&quot; {
    scope                = var.key_vault_id
    role_definition_name = &quot;Key Vault Crypto Officer&quot;
    principal_id         = azurerm_storage_account.this.identity[0].principal_id
  }
  
  resource &quot;azurerm_key_vault_managed_storage_account&quot; &quot;this&quot; {
    name                         = azurerm_storage_account.this.name
    key_vault_id                 = var.key_vault_id
    storage_account_id           = azurerm_storage_account.this.id
    storage_account_key          = &quot;key1&quot;
    regenerate_key_automatically = true
    regeneration_period          = &quot;P1D&quot;
  }
  </code></pre>
  
Tags: <terraform><azure><permissions>
Title: Key Vault managed stored account encryption permissions denied
UserDisplayName: Stuart.Sklinar
ThreadText: # Key Vault managed stored account encryption permissions denied
  
  (Asked by: username_0 on 2023-08-18)
  
  Trying to amend an existing storage account to add Customer-Managed-Key Rotation to it, using key vault, as per the docs from Terraform and MS.
  
  Looks like we've done everything right, but we're just getting permissions errors, and not even setting admin seems to resolve it.
  
  Now if we were using access policies, which all the docs do, I suspect it would be fine, but I can't find any roles that explicitly say `Microsoft.KeyVault/vaults/storageaccounts/read` (`They do say Microsoft.KeyVault/vaults/*/read though`).
  
  Given it looks like its' trying to access storage, I also granted my SPN access to that (Even though it already had contrib - but no dice).
  
  The specific url failing is:
  
  <https://kmykv.vault.azure.net/storage/mystorageaccount?api-version=7.4>:
  
  ```
  Checking for presence of existing Managed Sctorage Account "mystorageaccoutn" (Key Vault "Key Vault (Subscription: \"a3141da1-06b2-4cae-8032-0000000\"\nResource Group Name: \"myrg\"\nKey Vault Name: \"myvault\")"): keyvault.BaseClient#GetStorageAccount: Failure responding to request: StatusCode=403 
  
  -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.
  
  \r\nCaller: appid=000000-00-4913-8a44-f6d8112355b0;oid=000000-ed7f-42d0-8f41-0000;iss=https://sts.windows.net/00000-1057-4117-ac28-80cdfe86f8c3/\r\nAction: 'Microsoft.KeyVault/vaults/storageaccounts/read'\r\nResource: '/subscriptions/00000-06b2-4cae-8032-0000/resourcegroups/myrg/providers/microsoft.keyvault/vaults/myvault'\r\nAssignment: (not found)\r\nDecisionReason: 'DeniedWithNoValidRBAC' \r\nVault: myvault;location=uksouth\r\n" InnerError={"code":"ForbiddenByRbac"}
  
  ```
  
  Terraform
  
  ```
  data "azurerm_client_config" "current" {}
  
  data "azuread_service_principal" "keyvaultspn" {
    #This is the SPN for KeyVault defined across AZ - https://learn.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys
    # display_name = "Azure Key Vault"
    application_id = "cfa8b339-82a2-471a-a3c9-0fc0be7a4093"
  }
  
  resource "azurerm_storage_account" "this" {
    name                              = "mystorageaccount"
    location                          = "uksouth"
    resource_group_name               = "myrg"
    
    identity {
      type = "SystemAssigned"
    }
  }
  
  resource "azurerm_role_assignment" "kvstoragerole" {
    scope                = azurerm_storage_account.this.id
    role_definition_name = "Storage Account Key Operator Service Role"
    principal_id         = data.azuread_service_principal.keyvaultspn.id
  }
  
  resource "azurerm_role_assignment" "storagekvrole" {
    scope                = var.key_vault_id
    role_definition_name = "Key Vault Crypto Officer"
    principal_id         = azurerm_storage_account.this.identity[0].principal_id
  }
  
  resource "azurerm_key_vault_managed_storage_account" "this" {
    name                         = azurerm_storage_account.this.name
    key_vault_id                 = var.key_vault_id
    storage_account_id           = azurerm_storage_account.this.id
    storage_account_key          = "key1"
    regenerate_key_automatically = true
    regeneration_period          = "P1D"
  }
  
  ```
  
  **Tags:** terraform, azure, permissions
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-08-31. Score: 0
  
  Check your Key-vault permission model under your Key Vault -> Settings -> Access Configuration on Azure portal.
  
  Azure keyvault mainly allows key vault access using two permission models.
  
  Azure role-based access control
  Vault access policy
  
  If you are using Azure role-based access control, make sure that you have given 'Key Vault Administrator' role to your service principal from Access Control (IAM) section of your key vault.
  
  Refer: <https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli>
  
  If you are using Vault access policy, make sure that you have added policy for your service principal with necessary permissions under Access Policies section of your key vault.
  
  You could also use:
  Set-AzKeyVaultAccessPolicy -VaultName "" -UserPrincipalName "user@domain.com" -PermissionsToSecrets delete,get,list,set
  
  > **Comments:**
  > **username_0**: Thanks - I did say on my post that I can't find the right role - which I thought suggests we're using RBAC. Anyway - resolved it, I was using the totally wrong TF resource  
  
  ---
  
  