The client with object id does not have authorization to perform action taggedTrafficConsumers/validate

user_414058 0
Viewed 2645

When using Azure Key Vault management REST API or cmdlet Add-AzureRmKeyVaultNetworkRule to allow a virtual network to access a key vault, I get the following error:

The client '{guid}' with object id '{guid}' does not have authorization to perform
action 'microsoft.network/virtualnetworks/taggedTrafficConsumers/validate/action'
over scope '/subscriptions/{guid}/resourcegroups/{resource-group}/providers/microsoft.network/virtualnetworks/{vnet-name}/taggedTrafficConsumers/Microsoft.KeyVault'

What is wrong?

azure-resource-manager azure-keyvault azure
4 Answers

Your subscription is not giving Microsoft.KeyVault resource provider permission to access Microsoft.Network resources. The fix is to register your subscription to Microsoft.KeyVault again:

Register-AzureRmResourceProvider -ProviderNamespace Microsoft.KeyVault

This will add required permissions for Microsoft.KeyVault and Microsoft.Network integrations, including the ability to limit access to a given Virtual Network.

For more information: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-supported-services

user_4140580
user_18407940

This feels like a bug/limitation in both the Azure Portal and Azure CLI. We ran into this when trying to allow a subnet of a VNET in subscription X to access a storage account in subscription Y.

For us, the workaround was to look-up the name of the service principal that was mentioned in the error in our Azure AD directory using the "Search your tenant" box on the "Overview" tab of the directory (NOT the subscription but the Azure AD directory for the tenant). The name of the SP turned out to be "Storage Resource Provider" (yours may be different, so that's why you need to look it up in Azure AD), so we granted that SP "Owner" role (temporarily) in the other subscription. Then provisioning worked!

There should be a finer-grained set of permissions you need to grant than just "Owner" but when we granted just the "validate" permission, we got a new error:

Failed to save firewall and virtual network settings for storage account 'XXX'. Error: An operation is currently performing on this storage account that requires exclusive access.

user_43422300

Also experienced this error when adding a vnet to a storage-account in another subscription.

Fixed by adding a storage-account to the subscription using the portal. Then the vnet could be added to the storage-account.

Note: the result is the same as @fernacolo does with a powershell command.

user_62848790
Related