A Microsoft offering that enables tracking of cloud usage and expenditures for Azure and other cloud providers.
Hello Padmanabhan M,
To resolve this, follow these steps:
Grant the necessary permissions to the Storage Account in Subscription B:
Assign the Storage Account Contributor role to the user/service principal (the identity performing the export) at the Storage Account level in Subscription B. This role provides the necessary permissions to the export process to create the cost export in the destination storage account.
Verify Role Assignments:
· Ensure that the user/service principal performing the cost export in Subscription A has the Cost Management Contributor role.
· In Subscription B, assign the Storage Account Contributor role at the storage account level for the user/service principal performing the export operation.
Steps to Grant Permissions:
· Assign Storage Account Contributor Role in Subscription B:
· Navigate to Subscription B > Storage Account.
· In the IAM (Identity and Access Management) section, add the Storage Account Contributor role to the user/service principal performing the operation.
Assign Cost Management Contributor Role in Subscription A:
If you haven't already, ensure the Cost Management Contributor role is assigned to the appropriate identity on Subscription A.
Verify Cross-Subscription Access:
Cross-subscription role assignments are sometimes tricky. Double-check the effective permissions using the Access Control (IAM) section in both subscriptions to ensure that the roles have been assigned properly.
Testing and Retry:
After updating the permissions, retry the cost export operation. The export process should now have the necessary permissions to write to the storage account in Subscription B.
Conclusion:
To fix the issue, the user/service principal executing the export in Subscription A needs to have the Storage Account Contributor role on the storage account in Subscription B. Additionally, ensure that the Cost Management Contributor role is properly assigned to the identity in Subscription A. After these adjustments, the export should proceed without the RBACAccessDenied error.