Cant use CMK encryption on Storage Account using User-Managed Identity

Santi 1 Reputation point
2022-02-16T15:41:27.383+00:00

Hi, I need help.

I have an storage account with an private endpoint, and I want to encrypt the data using a CMK. The Keyvault is also with a private endpoint and when I try to connect both using a user-assigned identity i get this error:

175051-imagen.png

The thing is that I've given the user all possible permissions on the key vault and the storage account. Furthermore, when I change the networking configuration of the keyvault and I allow all networks, it works. So it seems that is because the user-assigned can't reach to the vault, but I dont know how to solve it without taking the private endpoint.

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,116 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,473 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,371 Reputation points Microsoft Employee
    2022-02-16T22:02:39.197+00:00

    @Santi
    Thank you for your post!

    From the article https://aka.ms/storagekeyvaultaccesspolicy within your error, the managed identity mi-keyvault-test-001 doesn't have the proper permissions to access Key Vault kv-test-010.
    175126-image.png

    Troubleshooting:

    Following the Configure encryption with customer-managed keys stored in Azure Key Vault documentation, you'll need to add your managed identity to your Key Vault's access policies.

    1) Navigate to your Key vault kv-test-010
    2) From the Overview page, confirm Soft-delete and Purge Protection are enabled for your vault, since this is required by Azure Storage encryption.
    175161-image.png

    3) Select Access Policies, then Add Access Policies.
    175115-image.png

    4) Select the permissions you'd like your Managed Identity to have. I selected the Azure Data Lake Storage or Azure Storage template.
    5) Select your managed identity mi-keyvault-test-001 as the principal. Select Add, then Save.
    175036-image.png

    6) Navigate to your Storage account and retry the operation.
    175070-image.png

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.