Trying to amend an existing storage account to add Customer-Managed-Key Rotation to it, using key vault, as per the docs from Terraform and MS.

Looks like we've done everything right, but we're just getting permissions errors, and not even setting admin seems to resolve it.

Now if we were using access policies, which all the docs do, I suspect it would be fine, but I can't find any roles that explicitly say Microsoft.KeyVault/vaults/storageaccounts/read (They do say Microsoft.KeyVault/vaults/*/read though).

Given it looks like its' trying to access storage, I also granted my SPN access to that (Even though it already had contrib - but no dice).

The specific url failing is:


Checking for presence of existing Managed Sctorage Account "mystorageaccoutn" (Key Vault "Key Vault (Subscription: \"a3141da1-06b2-4cae-8032-0000000\"\nResource Group Name: \"myrg\"\nKey Vault Name: \"myvault\")"): keyvault.BaseClient#GetStorageAccount: Failure responding to request: StatusCode=403 

-- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.

\r\nCaller: appid=000000-00-4913-8a44-f6d8112355b0;oid=000000-ed7f-42d0-8f41-0000;iss=https://sts.windows.net/00000-1057-4117-ac28-80cdfe86f8c3/\r\nAction: 'Microsoft.KeyVault/vaults/storageaccounts/read'\r\nResource: '/subscriptions/00000-06b2-4cae-8032-0000/resourcegroups/myrg/providers/microsoft.keyvault/vaults/myvault'\r\nAssignment: (not found)\r\nDecisionReason: 'DeniedWithNoValidRBAC' \r\nVault: myvault;location=uksouth\r\n" InnerError={"code":"ForbiddenByRbac"}


data "azurerm_client_config" "current" {}

data "azuread_service_principal" "keyvaultspn" {
  #This is the SPN for KeyVault defined across AZ - https://learn.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys
  # display_name = "Azure Key Vault"
  application_id = "cfa8b339-82a2-471a-a3c9-0fc0be7a4093"

resource "azurerm_storage_account" "this" {
  name                              = "mystorageaccount"
  location                          = "uksouth"
  resource_group_name               = "myrg"
  identity {
    type = "SystemAssigned"

resource "azurerm_role_assignment" "kvstoragerole" {
  scope                = azurerm_storage_account.this.id
  role_definition_name = "Storage Account Key Operator Service Role"
  principal_id         = data.azuread_service_principal.keyvaultspn.id

resource "azurerm_role_assignment" "storagekvrole" {
  scope                = var.key_vault_id
  role_definition_name = "Key Vault Crypto Officer"
  principal_id         = azurerm_storage_account.this.identity[0].principal_id

resource "azurerm_key_vault_managed_storage_account" "this" {
  name                         = azurerm_storage_account.this.name
  key_vault_id                 = var.key_vault_id
  storage_account_id           = azurerm_storage_account.this.id
  storage_account_key          = "key1"
  regenerate_key_automatically = true
  regeneration_period          = "P1D"

1 Answer 1


Check your Key-vault permission model under your Key Vault -> Settings -> Access Configuration on Azure portal.

Azure keyvault mainly allows key vault access using two permission models.

Azure role-based access control Vault access policy

If you are using Azure role-based access control, make sure that you have given 'Key Vault Administrator' role to your service principal from Access Control (IAM) section of your key vault.

Refer: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

If you are using Vault access policy, make sure that you have added policy for your service principal with necessary permissions under Access Policies section of your key vault.

You could also use: Set-AzKeyVaultAccessPolicy -VaultName "" -UserPrincipalName "[email protected]" -PermissionsToSecrets delete,get,list,set

  • Thanks - I did say on my post that I can't find the right role - which I thought suggests we're using RBAC. Anyway - resolved it, I was using the totally wrong TF resource Sep 1, 2023 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.