<p>Check your Key-vault permission model under your Key Vault -&gt; Settings -&gt; Access Configuration on Azure portal.</p>
<p>Azure keyvault mainly allows key vault access using two permission models.</p>
<p>Azure role-based access control
Vault access policy</p>
<p>If you are using Azure role-based access control, make sure that you have given 'Key Vault Administrator' role to your service principal from Access Control (IAM) section of your key vault.</p>
<p>Refer: <a href="https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli</a></p>
<p>If you are using Vault access policy, make sure that you have added policy for your service principal with necessary permissions under Access Policies section of your key vault.</p>
<p>You could also use:
Set-AzKeyVaultAccessPolicy -VaultName &quot;&quot; -UserPrincipalName &quot;user@domain.com&quot; -PermissionsToSecrets delete,get,list,set</p>

CC BY-SA 4.0
2023-09-01T08:03:24.543Z
Thanks - I did say on my post that I can't find the right role - which I thought suggests we're using RBAC. Anyway - resolved it, I was using the totally wrong TF resource
Stuart.Sklinar
CC BY-SA 4.0
2023-08-31T15:53:36.690Z
2023-08-31T16:02:35.363Z
2023-08-31T16:02:35.363Z
geeky_girl
<p>Trying to amend an existing storage account to add Customer-Managed-Key Rotation to it, using key vault, as per the docs from Terraform and MS.</p>
<p>Looks like we've done everything right, but we're just getting permissions errors, and not even setting admin seems to resolve it.</p>
<p>Now if we were using access policies, which all the docs do, I suspect it would be fine, but I can't find any roles that explicitly say <code>Microsoft.KeyVault/vaults/storageaccounts/read</code> (<code>They do say Microsoft.KeyVault/vaults/*/read though</code>).</p>
<p>Given it looks like its' trying to access storage, I also granted my SPN access to that (Even though it already had contrib - but no dice).</p>
<p>The specific url failing is:</p>
<p><a href="https://kmykv.vault.azure.net/storage/mystorageaccount?api-version=7.4" rel="nofollow noreferrer">https://kmykv.vault.azure.net/storage/mystorageaccount?api-version=7.4</a>:</p>
<pre><code>Checking for presence of existing Managed Sctorage Account &quot;mystorageaccoutn&quot; (Key Vault &quot;Key Vault (Subscription: \&quot;a3141da1-06b2-4cae-8032-0000000\&quot;\nResource Group Name: \&quot;myrg\&quot;\nKey Vault Name: \&quot;myvault\&quot;)&quot;): keyvault.BaseClient#GetStorageAccount: Failure responding to request: StatusCode=403 

-- Original Error: autorest/azure: Service returned an error. Status=403 Code=&quot;Forbidden&quot; Message=&quot;Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.

\r\nCaller: appid=000000-00-4913-8a44-f6d8112355b0;oid=000000-ed7f-42d0-8f41-0000;iss=https://sts.windows.net/00000-1057-4117-ac28-80cdfe86f8c3/\r\nAction: 'Microsoft.KeyVault/vaults/storageaccounts/read'\r\nResource: '/subscriptions/00000-06b2-4cae-8032-0000/resourcegroups/myrg/providers/microsoft.keyvault/vaults/myvault'\r\nAssignment: (not found)\r\nDecisionReason: 'DeniedWithNoValidRBAC' \r\nVault: myvault;location=uksouth\r\n&quot; InnerError={&quot;code&quot;:&quot;ForbiddenByRbac&quot;}
</code></pre>
<p>Terraform</p>
<pre><code>data &quot;azurerm_client_config&quot; &quot;current&quot; {}

data &quot;azuread_service_principal&quot; &quot;keyvaultspn&quot; {
  #This is the SPN for KeyVault defined across AZ - https://learn.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys
  # display_name = &quot;Azure Key Vault&quot;
  application_id = &quot;cfa8b339-82a2-471a-a3c9-0fc0be7a4093&quot;
}


resource &quot;azurerm_storage_account&quot; &quot;this&quot; {
  name                              = &quot;mystorageaccount&quot;
  location                          = &quot;uksouth&quot;
  resource_group_name               = &quot;myrg&quot;
  
  identity {
    type = &quot;SystemAssigned&quot;
  }
}

resource &quot;azurerm_role_assignment&quot; &quot;kvstoragerole&quot; {
  scope                = azurerm_storage_account.this.id
  role_definition_name = &quot;Storage Account Key Operator Service Role&quot;
  principal_id         = data.azuread_service_principal.keyvaultspn.id
}

resource &quot;azurerm_role_assignment&quot; &quot;storagekvrole&quot; {
  scope                = var.key_vault_id
  role_definition_name = &quot;Key Vault Crypto Officer&quot;
  principal_id         = azurerm_storage_account.this.identity[0].principal_id
}

resource &quot;azurerm_key_vault_managed_storage_account&quot; &quot;this&quot; {
  name                         = azurerm_storage_account.this.name
  key_vault_id                 = var.key_vault_id
  storage_account_id           = azurerm_storage_account.this.id
  storage_account_key          = &quot;key1&quot;
  regenerate_key_automatically = true
  regeneration_period          = &quot;P1D&quot;
}
</code></pre>

<terraform><azure><permissions>
Key Vault managed stored account encryption permissions denied
Stuart.Sklinar
# Key Vault managed stored account encryption permissions denied

(Asked by: username_0 on 2023-08-18)

Trying to amend an existing storage account to add Customer-Managed-Key Rotation to it, using key vault, as per the docs from Terraform and MS.
Looks like we've done everything right, but we're just getting permissions errors, and not even setting admin seems to resolve it.
Now if we were using access policies, which all the docs do, I suspect it would be fine, but I can't find any roles that explicitly say Microsoft.KeyVault/vaults/storageaccounts/read (They do say Microsoft.KeyVault/vaults/*/read though).
Given it looks like its' trying to access storage, I also granted my SPN access to that (Even though it already had contrib - but no dice).
The specific url failing is:
https://kmykv.vault.azure.net/storage/mystorageaccount?api-version=7.4:
Checking for presence of existing Managed Sctorage Account "mystorageaccoutn" (Key Vault "Key Vault (Subscription: \"a3141da1-06b2-4cae-8032-0000000\"\nResource Group Name: \"myrg\"\nKey Vault Name: \"myvault\")"): keyvault.BaseClient#GetStorageAccount: Failure responding to request: StatusCode=403 

-- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.

\r\nCaller: appid=000000-00-4913-8a44-f6d8112355b0;oid=000000-ed7f-42d0-8f41-0000;iss=https://sts.windows.net/00000-1057-4117-ac28-80cdfe86f8c3/\r\nAction: 'Microsoft.KeyVault/vaults/storageaccounts/read'\r\nResource: '/subscriptions/00000-06b2-4cae-8032-0000/resourcegroups/myrg/providers/microsoft.keyvault/vaults/myvault'\r\nAssignment: (not found)\r\nDecisionReason: 'DeniedWithNoValidRBAC' \r\nVault: myvault;location=uksouth\r\n" InnerError={"code":"ForbiddenByRbac"}

Terraform
data "azurerm_client_config" "current" {}

data "azuread_service_principal" "keyvaultspn" {
  #This is the SPN for KeyVault defined across AZ - https://learn.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys
  # display_name = "Azure Key Vault"
  application_id = "cfa8b339-82a2-471a-a3c9-0fc0be7a4093"
}


resource "azurerm_storage_account" "this" {
  name                              = "mystorageaccount"
  location                          = "uksouth"
  resource_group_name               = "myrg"
  
  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_role_assignment" "kvstoragerole" {
  scope                = azurerm_storage_account.this.id
  role_definition_name = "Storage Account Key Operator Service Role"
  principal_id         = data.azuread_service_principal.keyvaultspn.id
}

resource "azurerm_role_assignment" "storagekvrole" {
  scope                = var.key_vault_id
  role_definition_name = "Key Vault Crypto Officer"
  principal_id         = azurerm_storage_account.this.identity[0].principal_id
}

resource "azurerm_key_vault_managed_storage_account" "this" {
  name                         = azurerm_storage_account.this.name
  key_vault_id                 = var.key_vault_id
  storage_account_id           = azurerm_storage_account.this.id
  storage_account_key          = "key1"
  regenerate_key_automatically = true
  regeneration_period          = "P1D"
}

**Tags:** terraform, azure, permissions


---

## 1 answers

### Answer by username_1 on 2023-08-31. Score: 0

Check your Key-vault permission model under your Key Vault -> Settings -> Access Configuration on Azure portal.

Azure keyvault mainly allows key vault access using two permission models.

Azure role-based access control
Vault access policy

If you are using Azure role-based access control, make sure that you have given 'Key Vault Administrator' role to your service principal from Access Control (IAM) section of your key vault.

Refer: <https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli>

If you are using Vault access policy, make sure that you have added policy for your service principal with necessary permissions under Access Policies section of your key vault.

You could also use:
Set-AzKeyVaultAccessPolicy -VaultName "" -UserPrincipalName "user@domain.com" -PermissionsToSecrets delete,get,list,set

> **Comments:**
> **username_0**: Thanks - I did say on my post that I can't find the right role - which I thought suggests we're using RBAC. Anyway - resolved it, I was using the totally wrong TF resource  

---

