Issue with executing $secret = Set-AzKeyVaultSecret -VaultName $KVNAME -Name vmPassword -SecretValue $secretSecureString

Question

Hi,

I was trying to use solutions from the internet like e.g. https://learn.microsoft.com/en-us/answers/questions/1726526/issue-creating-secrets-when-working-on-exercise , but this is impossible to add any access policies in azure portal when using Concierge Subscription Microsoft Learn Sandbox, so I can't complete the exercise from the point mentioned below.

This is how it looks in my PS (when following https://learn.microsoft.com/en-us/training/modules/manage-deployments-advanced-arm-template-features/5-secure-parameters-exercise?pivots=powershell):

PS C:\Users\eweli> $KVNAME="tailwind-secrets" + (Get-Random -Count 1 -Maximum 9999999)

PS C:\Users\eweli> $KVNAME

tailwind-secrets7174552

PS C:\Users\eweli> $secretSecureString = ConvertTo-SecureString 'insecurepassword123!' -AsPlainText -Force

PS C:\Users\eweli> $secret = Set-AzKeyVaultSecret -VaultName $KVNAME -Name vmPassword -SecretValue $secretSecureString

Set-AzKeyVaultSecret: Operation returned an invalid status code 'Forbidden'

Code: Forbidden

Message: Caller is not authorized to perform action on resource.

If role assignments, deny assignments or role definitions were changed recently, please observe propagation time.

Caller: appid=1950a258-227b-4e31-a9cf-717495945fc2;oid=2d4fd02d-6a48-437d-88b3-6e009eeddd32;iss=https://sts.windows.net/604c1504-c6a3-4080-81aa-b33091104187/

Action: 'Microsoft.KeyVault/vaults/secrets/setSecret/action'

Resource: '/subscriptions/9e2deb73-2f73-46d9-96f9-f94827200755/resourcegroups/learn-58a3048d-b977-4ebc-aac6-9a00b895d1bd/providers/microsoft.keyvault/vaults/tailwind-secrets7174552/secrets/vmpassword'

Assignment: (not found)

DenyAssignmentId: null

DecisionReason: null

Vault: tailwind-secrets7174552;location=eastus

PS C:\Users\eweli> $secret = Set-AzKeyVaultSecret -VaultName $KVNAME -Name vmPassword -SecretValue $secretSecureString

This question is related to the following Learning Module

Answer 1

Hi Ewelina Ośko,

It looks like you're encountering a permissions issue when trying to set a secret in your Azure Key Vault. The error message indicates that your user or service principal does not have the necessary permissions to perform this action. Here’s how you can resolve this issue:

Steps to Resolve the Issue

Step 1: Assign Key Vault Access Policy

1. Using Azure Portal:
   • Go to your Azure Key Vault in the Azure Portal.
   • In the Key Vault settings, select Access policies.
   • Click on + Add Access Policy.
   • In the Configure from template dropdown, select Secret Management.
   • Under Select principal, search for your user or the service principal (the oid mentioned in your error message).
   • Click Add and then Save.
   Using Azure CLI:
   • You can also assign the access policy using the Azure CLI. Replace <YourKeyVaultName> and <YourPrincipalId> with your actual Key Vault name and principal ID.

   bash 1az keyvault set-policy --name <YourKeyVaultName> --spn <YourPrincipalId> --secret-permissions set

         
      ```sql
        - If you are using a user account, use **`--upn`** instead of **`--spn`**.
      ```Step 2: Assign Role-Based Access Control (RBAC) Role
   
   

2. Using Azure Portal:
   • Navigate to the Azure Key Vault in the Azure Portal.
   • Select Access control (IAM).
   • Click on Add role assignment.
   • Select the role Key Vault Secrets Officer or Key Vault Contributor.
   • Assign this role to your user or service principal.
   Using Azure CLI:
   • You can also assign the RBAC role using the Azure CLI. Replace the placeholders with your actual values.

         bash
         1az role assignment create --assignee <YourPrincipalId> --role "Key Vault Secrets Officer" --scope /subscriptions/<YourSubscriptionId>/resourceGroups/<YourResourceGroupName>/providers/Microsoft.KeyVault/vaults/<YourKeyVaultName>
   

Example

If your Key Vault name is tailwind-secrets7174552 and you need to assign access to the service principal with oid 2d4fd02d-6a48-437d-88b3-6e009eeddd32, you would use the following commands:

Azure CLI - Assign Access Policy

bash
1az keyvault set-policy --name tailwind-secrets7174552 --spn 2d4fd02d-6a48-437d-88b3-6e009eeddd32 --secret-permissions set

Azure CLI - Assign RBAC Role

bash
1az role assignment create --assignee 2d4fd02d-6a48-437d-88b3-6e009eeddd32 --role "Key Vault Secrets Officer" --scope /subscriptions/9e2deb73-2f73-46d9-96f9-f94827200755/resourceGroups/learn-58a3048d-b977-4ebc-aac6-9a00b895d1bd/providers/Microsoft.KeyVault/vaults/tailwind-secrets7174552

Step 3: Wait for Propagation

After making these changes, it may take a few minutes for the permissions to propagate. Wait for a short period and then retry the command:

powershell
1Set-AzKeyVaultSecret -VaultName $KVNAME -Name 'vmPassword' -SecretValue (ConvertTo-SecureString "insecurepassword123!" -AsPlainText -Force)

Final Considerations

1. Check Propagation Time: Permissions changes can sometimes take a few minutes to propagate.
2. Verify Principal: Ensure you are assigning permissions to the correct user or service principal.
3. Check Existing Policies: Ensure there are no conflicting policies that might deny access.

By following these steps, you should be able to resolve the authorization issue and successfully set a secret in your Azure Key Vault. If you have any further questions or run into issues, feel free to ask!It looks like you're encountering a permissions issue when trying to set a secret in your Azure Key Vault. The error message indicates that your user or service principal does not have the necessary permissions to perform this action. Here’s how you can resolve this issue:

Steps to Resolve the Issue

Step 1: Assign Key Vault Access Policy

1. Using Azure Portal:

• Go to your Azure Key Vault in the Azure Portal. In the Key Vault settings, select Access policies.
  • Click on + Add Access Policy.
  • In the Configure from template (optional) dropdown, select Secret Management.
  • Under Select principal, search for your user or the service principal (the oid mentioned in your error message).
  • Click Add and then Save.
  Using Azure CLI:

    - You can also assign the access policy using the Azure CLI. Replace **`<YourKeyVaultName>`** and **`<YourPrincipalId>`** with your actual Key Vault name and principal ID.
    
    
    powershell
    bash
    1az keyvault set-policy --name <YourKeyVaultName> --spn <YourPrincipalId> --secret-permissions set
  

  • If you are using a user account, use --upn instead of --spn.

• Navigate to the Azure Key Vault in the Azure Portal.
  • Select Access control (IAM).
    • Click on Add role assignment.
      • Select the role Key Vault Secrets Officer or Key Vault Contributor.
        • Assign this role to your user or service principal.
        Using Azure CLI:

                - You can also assign the RBAC role using the Azure CLI. Replace the placeholders with your actual values.
                
                
                ```powershell
                bash
                1az role assignment create --assignee <YourPrincipalId> --role "Key Vault Secrets Officer" --scope /subscriptions/<YourSubscriptionId>/resourceGroups/<YourResourceGroupName>/providers/Microsoft.KeyVault/vaults/<YourKeyVaultName>
        

If your Key Vault name is tailwind-secrets7174552 and you need to assign access to the service principal with oid 2d4fd02d-6a48-437d-88b3-6e009eeddd32, you would use the following commands:

Azure CLI - Assign Access Policy

bash
1az keyvault set-policy --name tailwind-secrets7174552 --spn 2d4fd02d-6a48-437d-88b3-6e009eeddd32 --secret-permissions set

Azure CLI - Assign RBAC Role

bash
1az role assignment create --assignee 2d4fd02d-6a48-437d-88b3-6e009eeddd32 --role "Key Vault Secrets Officer" --scope /subscriptions/9e2deb73-2f73-46d9-96f9-f94827200755/resourceGroups/learn-58a3048d-b977-4ebc-aac6-9a00b895d1bd/providers/Microsoft.KeyVault/vaults/tailwind-secrets7174552

Step 3: Wait for Propagation

After making these changes, it may take a few minutes for the permissions to propagate. Wait for a short period and then retry the command:

powershell
1Set-AzKeyVaultSecret -VaultName $KVNAME -Name 'vmPassword' -SecretValue (ConvertTo-SecureString "insecurepassword123!" -AsPlainText -Force)

Final Considerations

1. Check Propagation Time: Permissions changes can sometimes take a few minutes to propagate.
2. Verify Principal: Ensure you are assigning permissions to the correct user or service principal.
3. Check Existing Policies: Ensure there are no conflicting policies that might deny access.

By following these steps, you should be able to resolve the authorization issue and successfully set a secret in your Azure Key Vault.

If you are still having issue, please reach out to us will be happy to assist you.