Terraform Customer Managed Key for Storage Account storage.AccountsClient#Update: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code=KeyVaultAuthenticationFailure

Jeeva 6

I am trying to create a storage account with CMK and using a user-assigned managed identity. The Terraform script I am using looks correct but running it throws this error and not sure why. The error message is not clear. I uploaded my tf file here for debugging.

If we assigned both "UserAssigned" and "SystemAssigned" as identities to a storage account which one is used for performing the encryption. What is the user for having both types of identities assigned to a storage account encryption?

If we assign a "UserAssigned" Identity, then this identity should have access to get/wrap/unwrap the encryption key from the vault (thru vault policies). Is this enough for this use case. Is there any additional permission given to the storage account?

224560-main.txt

JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2022-07-26T23:49:34.517+00:00
@Jeeva
Thank you for your post!

From the error that you received, it looks like it could be more related to an authentication issue and not an access policy (Access Denied) issue. Based off your .txt, I saw some Network ACLS - when creating your Key Vault are you creating Networking rules?

Can you share any documentation that you're following so I can gain a better understanding of your issue?

From your .txt, it seems like everything is creating successfully until you get to the creation of CMK. Have you tried manually enabling CMK within the Portal to see if it works with the currently deployed resources?

Additional Links:
Azure Key Vault REST API Error Codes
Common error codes for Azure Key Vault

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Jeeva 6 Reputation points

2022-07-27T10:39:14.61+00:00
From the error that you received, it looks like it could be more related to an authentication issue and not an access policy (Access Denied) issue. Based off your .txt, I saw some Network ACLS - when creating your Key Vault are you creating Networking rules?
Not at the moment. No Network rules.

Can you share any documentation that you're following so I can gain a better understanding of your issue?
I couldn't find an example which uses user-assigned identity with Customer managed encryption key. So I am simply following both Ms And Terraform docs as reference.

From your .txt, it seems like everything is creating successfully until you get to the creation of CMK. Have you tried manually enabling CMK within the Portal to see if it works with the currently deployed resources?
Yes, Tried that manually and it works. It only happens when you do it through Tf script.
Jeeva 6 Reputation points

2022-07-27T10:41:48.3+00:00

Could you clarify the significance of having both UserAssigned and SystemAssigend identities for the Storage accounts for CME Key?

I can see it assigns two identities to the storage account but not sure which one is used to retrieving the encryption key from Key Vault?
Jeeva 6 Reputation points

2022-07-29T00:36:44.147+00:00

@JamesTran-MSFT
Jeeva 6 Reputation points

2022-07-29T00:36:52.01+00:00

@JamesTran-MSFT
JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2022-08-01T20:07:54.233+00:00
@Jeeva
Thank you for following up on this and I apologize for the delayed response!

For the MS and Terraform docs, can you share the links to them so I can gain a better understanding of what you're following?

When it comes to configuring encryption with customer-managed keys on a Storage Account, you should only be able to leverage one Identity - either User Assigned or System Assigned. For more info.

If you're setting both a User Assigned and System Assigned Identity within your Terraform script, can you navigate to your Storage Account within the Portal to see what type of Identity is being used?

If system assigned identity is enabled and no identity is specified in the request, Azure Instance Metadata Service (IMDS) defaults to the system assigned managed identity.

If system assigned identity isn't enabled, and only one user assigned managed identity exists, IMDS defaults to that single user assigned managed identity.

If system assigned identity isn't enabled, and multiple user assigned managed identities exist, then you are required to specify a managed identity in the request.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
JamesTran-MSFT 36,366 Reputation points Microsoft Employee

2022-08-08T20:31:56.667+00:00

@Jeeva
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

2 answers

VIVEK DWIVEDI 25 Reputation points

2023-01-15T17:11:42.9366667+00:00

I have the same issue, the only difference is I am using a system-assigned identity and on the key vault, access is through RBAC. The key vault key officer role is granted to system-managed identity, which is verified too.

It is not yet solved.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Viral 0 Reputation points

2023-03-15T19:17:31.6733333+00:00

I'm having same issue, as there been any movement on this?
Please sign in to rate this answer.

0 comments No comments
Sign in to comment