Key Vault managed stored account encryption permissions denied

Question

Trying to amend an existing storage account to add Customer-Managed-Key Rotation to it, using key vault, as per the docs from Terraform and MS.

Looks like we've done everything right, but we're just getting permissions errors, and not even setting admin seems to resolve it.

Now if we were using access policies, which all the docs do, I suspect it would be fine, but I can't find any roles that explicitly say Microsoft.KeyVault/vaults/storageaccounts/read (They do say Microsoft.KeyVault/vaults/*/read though).

Given it looks like its' trying to access storage, I also granted my SPN access to that (Even though it already had contrib - but no dice).

The specific url failing is:

https://kmykv.vault.azure.net/storage/mystorageaccount?api-version=7.4:

Checking for presence of existing Managed Sctorage Account "mystorageaccoutn" (Key Vault "Key Vault (Subscription: \"a3141da1-06b2-4cae-8032-0000000\"\nResource Group Name: \"myrg\"\nKey Vault Name: \"myvault\")"): keyvault.BaseClient#GetStorageAccount: Failure responding to request: StatusCode=403 

-- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Caller is not authorized to perform action on resource.\r\nIf role assignments, deny assignments or role definitions were changed recently, please observe propagation time.

\r\nCaller: appid=000000-00-4913-8a44-f6d8112355b0;oid=000000-ed7f-42d0-8f41-0000;iss=https://sts.windows.net/00000-1057-4117-ac28-80cdfe86f8c3/\r\nAction: 'Microsoft.KeyVault/vaults/storageaccounts/read'\r\nResource: '/subscriptions/00000-06b2-4cae-8032-0000/resourcegroups/myrg/providers/microsoft.keyvault/vaults/myvault'\r\nAssignment: (not found)\r\nDecisionReason: 'DeniedWithNoValidRBAC' \r\nVault: myvault;location=uksouth\r\n" InnerError={"code":"ForbiddenByRbac"}

Terraform

data "azurerm_client_config" "current" {}

data "azuread_service_principal" "keyvaultspn" {
  #This is the SPN for KeyVault defined across AZ - https://learn.microsoft.com/en-us/azure/key-vault/secrets/overview-storage-keys
  # display_name = "Azure Key Vault"
  application_id = "cfa8b339-82a2-471a-a3c9-0fc0be7a4093"
}


resource "azurerm_storage_account" "this" {
  name                              = "mystorageaccount"
  location                          = "uksouth"
  resource_group_name               = "myrg"
  
  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_role_assignment" "kvstoragerole" {
  scope                = azurerm_storage_account.this.id
  role_definition_name = "Storage Account Key Operator Service Role"
  principal_id         = data.azuread_service_principal.keyvaultspn.id
}

resource "azurerm_role_assignment" "storagekvrole" {
  scope                = var.key_vault_id
  role_definition_name = "Key Vault Crypto Officer"
  principal_id         = azurerm_storage_account.this.identity[0].principal_id
}

resource "azurerm_key_vault_managed_storage_account" "this" {
  name                         = azurerm_storage_account.this.name
  key_vault_id                 = var.key_vault_id
  storage_account_id           = azurerm_storage_account.this.id
  storage_account_key          = "key1"
  regenerate_key_automatically = true
  regeneration_period          = "P1D"
}

Answer 1

Check your Key-vault permission model under your Key Vault -> Settings -> Access Configuration on Azure portal.

Azure keyvault mainly allows key vault access using two permission models.

Azure role-based access control Vault access policy

If you are using Azure role-based access control, make sure that you have given 'Key Vault Administrator' role to your service principal from Access Control (IAM) section of your key vault.

Refer: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

If you are using Vault access policy, make sure that you have added policy for your service principal with necessary permissions under Access Policies section of your key vault.

You could also use: Set-AzKeyVaultAccessPolicy -VaultName "" -UserPrincipalName "[email protected]" -PermissionsToSecrets delete,get,list,set