Unable to set 'server parameters' in Postgres SQL Flexible Server on Azure

Question

HI All,

I'm trying to set a dynamic parameter, require_secure_transport parameter on Azure Database for PostgreSQL flexible server. I've got contributor rights but getting the following error.

The client '******@xxx.xxx' with object id

'xxx' does not have authorization

to perform action 'Microsoft.Resources/deployments/validate/action' over

scope '/subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Resources/deployments/PostgreSQLFlexibleServerParameters_xxxx'

or the scope is invalid. If access was recently granted, please refresh your

credentials.

The client is an internal user of the tenant with contributor access to the Postgres Flexible Server.

Please assist. Thanks.

Answer 1

Hi @Danny Chuah,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Issue:

I'm trying to set a dynamic parameter, require_secure_transport parameter on Azure Database for PostgreSQL flexible server. I've got contributor rights but getting the following error.

The client '******@xxx.xxx' with object id

'xxx' does not have authorization

to perform action 'Microsoft.Resources/deployments/validate/action' over

scope '/subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Resources/deployments/PostgreSQLFlexibleServerParameters_xxxx'

or the scope is invalid. If access was recently granted, please refresh your

credentials.

The client is an internal user of the tenant with contributor access to the Postgres Flexible Server.

Please assist. Thanks.

Solution:

I've found the solution. The issue was the user account only had Reader role to the resource group housing the affected Postgres Flex Server, after giving the user contributor role to the resource group was the user able to make 'server parameters' changes on the postgres flex server.

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

The error message you encountered suggests an authorization issue related to your attempt to modify the require_secure_transport parameter for the Azure Database for PostgreSQL Flexible Server. This usually happens due to insufficient permissions, even though you have Contributor rights.

Possible Causes:

Insufficient Permissions for Deployment Actions: Even though you have Contributor access, some actions like validating and modifying resource parameters through deployments might require Owner or User Access Administrator roles because they involve managing resource deployments and parameters at a broader level.

Delay in Permission Propagation: Permissions might not propagate immediately after they are granted. The error message suggests refreshing credentials, which can be done by re-authenticating with Azure or waiting for permissions to be fully applied.

Incorrect Scope: The scope specified in the error (/subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Resources/deployments/PostgreSQLFlexibleServerParameters_xxxx) might not align with your access level. Contributor rights on the specific resource may not cover all deployment operations, especially if the action affects resource deployments at a higher level.

Steps to Resolve:

Refresh Credentials: Sign out and sign back in to the Azure portal or your CLI/PowerShell session to refresh your credentials.

Check Role Assignments: Verify that your user has the appropriate role for the resource group or subscription scope where the PostgreSQL flexible server resides:

• Go to the Resource Group or Subscription in the Azure portal.
  • Navigate to Access control (IAM) and verify your role assignments.
  Elevate Permissions:

  - If the deployment action involves creating or modifying resource parameters, you may need **Owner** or **User Access Administrator** rights.
  
     - Request additional permissions from the administrator, especially if you’re managing sensitive parameters.
  
     **Run Deployment in the Portal**: If you are performing the operation via the Azure CLI or API, try running the same operation through the Azure portal to see if it bypasses the authorization issue.
  

1. Check with the Azure Administrator: Reach out to your Azure admin to confirm if any custom policies or role restrictions are in place that might prevent you from executing deployment-related actions.The error message you encountered suggests an authorization issue related to your attempt to modify the require_secure_transport parameter for the Azure Database for PostgreSQL Flexible Server. This usually happens due to insufficient permissions, even though you have Contributor rights. Possible Causes:
   1. Insufficient Permissions for Deployment Actions:
      Even though you have Contributor access, some actions like validating and modifying resource parameters through deployments might require Owner or User Access Administrator roles because they involve managing resource deployments and parameters at a broader level.
   2. Delay in Permission Propagation:
      Permissions might not propagate immediately after they are granted. The error message suggests refreshing credentials, which can be done by re-authenticating with Azure or waiting for permissions to be fully applied.
   3. Incorrect Scope:
      The scope specified in the error (/subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Resources/deployments/PostgreSQLFlexibleServerParameters_xxxx) might not align with your access level. Contributor rights on the specific resource may not cover all deployment operations, especially if the action affects resource deployments at a higher level.
   Steps to Resolve:
   1. Refresh Credentials:
      Sign out and sign back in to the Azure portal or your CLI/PowerShell session to refresh your credentials.
   2. Check Role Assignments:
      Verify that your user has the appropriate role for the resource group or subscription scope where the PostgreSQL flexible server resides:
      • Go to the Resource Group or Subscription in the Azure portal.
      • Navigate to Access control (IAM) and verify your role assignments.
   3. Elevate Permissions:
      • If the deployment action involves creating or modifying resource parameters, you may need Owner or User Access Administrator rights.
      • Request additional permissions from the administrator, especially if you’re managing sensitive parameters.
   4. Run Deployment in the Portal:
      If you are performing the operation via the Azure CLI or API, try running the same operation through the Azure portal to see if it bypasses the authorization issue.
   5. Check with the Azure Administrator:
      Reach out to your Azure admin to confirm if any custom policies or role restrictions are in place that might prevent you from executing deployment-related actions.

Answer 3

Hi Sai,

I have 2 postgres flex servers deployed with the same settings, one for test and one for production. The user have the same contributor role for both servers. On the test server he was able to make changes to server parameters but on the production server he been presented with the error as I stated in my original post. Could you give me advise on what to check please? Thanks.