Add-AzKeyVaultManagedStorageAccount : Operation returned an invalid status code 'Forbidden'
Question
Answers
All replies
-
Hello flahm,
I apologize for the delay in my response, as i was tied up with few other commitments.
I did check your cmdlets and the outputs that you shared. Now based on the final error, the issue is still regarding Permissions. Now while i checked your cmdlets thoroughly, i see that your KeyVault doesnt have any access policies defined for it.
Your output:
PS C:\Users> $keyVault | Format-List Vault Name : cmk-key-vault-5121 Resource Group Name : cmk-key-vault-5121 Location : westus Resource ID : /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx/resourceGWhiteroups/cmk-key-vault-5121/providers/Microsoft.KeyVault/vaults/cmk-key-vault-5121 Vault URI : https://cmk-key-vault-5121.vault.azure.net/ Tenant ID : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx SKU : Premium Enabled For Deployment? : False Enabled For Template Deployment? : False Enabled For Disk Encryption? : False Soft Delete Enabled? : Access Policies : Network Rule Set : Default Action : Allow Bypass : AzureServices IP Rules : Virtual Network Rules : Tags :
Output from my repro:
PS C:\windows\system32> Get-AzKeyVault -VaultName StorageKeyVault1112 | fl Vault Name : StorageKeyVault1112 Resource Group Name : StorageKeyVaultRG Location : northcentralus Resource ID : /subscriptions/04c48986-6495-4bf4-b098-92e5f1233cf0/resourceGroups/StorageKeyVaultRG/prov iders/Microsoft.KeyVault/vaults/StorageKeyVault1112 Vault URI : https://storagekeyvault1112.vault.azure.net/ Tenant ID : c2d4955e-81d6-462b-8388-68a5ce8dc243 SKU : Standard Enabled For Deployment? : False Enabled For Template Deployment? : False Enabled For Disk Encryption? : False Soft Delete Enabled? : Access Policies : Tenant ID : c2d4955e-81d6-462b-8388-68a5ce8dc243 Object ID : f0666658-c3e8-4d34-995e-2c5242df41d7 Application ID : Display Name : Sourav Mishra (sourav@soumimsft.onmicrosoft.com) Permissions to Keys : Get, List, Update, Create, Import, Delete, Recover, Backup, Restore Permissions to Secrets : Get, List, Set, Delete, Recover, Backup, Restore Permissions to Certificates : Get, List, Update, Create, Import, Delete, Recover, Backup, Restore, ManageContacts, ManageIssuers, GetIssuers, ListIssuers, SetIssuers, DeleteIssuers Permissions to (Key Vault Managed) Storage : get, list, delete, set, update, regeneratekey, getsas, listsas, deletesas, setsas, recover, backup, restore, purge Network Rule Set : Default Action : Allow Bypass : AzureServices IP Rules : Virtual Network Rules : Tags :
Now, if you compare both the outputs you will find that for my lab repro, I have access policies listed under the get-azKeyVault cmdlet.
Also, another thing that I found in your cmdlets that you ran was that you did try to assign the Access policies to the key vault but somehow the assignment didnt work out and secondly, you tried assigning the KeyVault's App id the following permissions for managing the storage ""get","list","listsas","delete","set","update","regeneratekey","recover","backup","restore","purge"" as per the cmdlet here:
PS C:\Users> $accessPolicy = @{ VaultName = $keyVault.VaultName ServicePrincipalName = "cfa8b339-82a2-471a-a3c9-0fc0be7a4093" PermissionsToStorage = ("get","list","listsas","delete","set","update","regeneratekey","recover","backup","restore","purge") }
This is not correct. In the access policies, you need to add the AppID (in case the operation is happening under an application) or an UPN of the user (if the operation is happening under an user) but not the KeyVault's App ID.
So the correct cmdlet to run would be:
$userId = (Get-AzContext).Account.Id Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName` -UserPrincipalName $userId` -PermissionsToStorage get, list, delete, set, update, regeneratekey, getsas, listsas, deletesas, setsas, recover, backup, restore, purge
I also tried to bring up that same "Forbidden" in an effort to reproduce the issue. I created a fresh Azure KeyVault and another Storage Account. Now for this new KeyVault, I have not added the user to the access policies for PermissionToStorage as you can see below:
Once you run the cmdlet: it would fail with the "Forbidden" error as below:Hope this helps in fixing the issue.
---------------------------------------------------------------------------------------------------------------------------------------
Please take a moment to "Mark as Answer" and/or "Vote as Helpful" wherever applicable. Thanks!
