CODEWITHSUNDEEP
azureazure-resource-managerazure-keyvault
fernacolo
fernacolo

Reputation: 7439

The client with object id does not have authorization to perform action taggedTrafficConsumers/validate

When using Azure Key Vault management REST API or cmdlet Add-AzureRmKeyVaultNetworkRule to allow a virtual network to access a key vault, I get the following error:

The client '{guid}' with object id '{guid}' does not have authorization to perform
action 'microsoft.network/virtualnetworks/taggedTrafficConsumers/validate/action'
over scope '/subscriptions/{guid}/resourcegroups/{resource-group}/providers/microsoft.network/virtualnetworks/{vnet-name}/taggedTrafficConsumers/Microsoft.KeyVault'

What is wrong?

Upvotes: 3

Views: 6856

Answers (4)

gjh71
gjh71

Reputation: 47

Also experienced this error when adding a vnet to a storage-account in another subscription.

Fixed by adding a storage-account to the subscription using the portal. Then the vnet could be added to the storage-account.

Note: the result is the same as @fernacolo does with a powershell command.

Upvotes: 0

GuyPaddock
GuyPaddock

Reputation: 2517

This feels like a bug/limitation in both the Azure Portal and Azure CLI. We ran into this when trying to allow a subnet of a VNET in subscription X to access a storage account in subscription Y.

For us, the workaround was to look-up the name of the service principal that was mentioned in the error in our Azure AD directory using the "Search your tenant" box on the "Overview" tab of the directory (NOT the subscription but the Azure AD directory for the tenant). The name of the SP turned out to be "Storage Resource Provider" (yours may be different, so that's why you need to look it up in Azure AD), so we granted that SP "Owner" role (temporarily) in the other subscription. Then provisioning worked!

There should be a finer-grained set of permissions you need to grant than just "Owner" but when we granted just the "validate" permission, we got a new error:

Failed to save firewall and virtual network settings for storage account 'XXX'. Error: An operation is currently performing on this storage account that requires exclusive access.

Upvotes: 0

David Noreña
David Noreña

Reputation: 4230

This are the steps required to solve it:

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-providers-and-types#azure-portal

You just need to register the resource provider in the subscription, this doesn't only happens with Key Vault, my issue was with Sql Server as well :)

So I leave this answer here in case someone else needs it

Upvotes: 0

fernacolo
fernacolo

Reputation: 7439

Your subscription is not giving Microsoft.KeyVault resource provider permission to access Microsoft.Network resources. The fix is to register your subscription to Microsoft.KeyVault again:

Register-AzureRmResourceProvider -ProviderNamespace Microsoft.KeyVault

This will add required permissions for Microsoft.KeyVault and Microsoft.Network integrations, including the ability to limit access to a given Virtual Network.

For more information: https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-supported-services

Upvotes: 4

Related Questions