2

I have been trying to figure out to fix the below problem while deploying Azure RM template.

New-AzureRmResourceGroupDeployment : 9:54:31 PM - Resource Microsoft.Web/certificates 'redacted' failed with message '{   "Code": "BadRequest",   "Message": "The service does not have access to '/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted' Key Vault. Please make sure that you have  granted necessary permissions to the service to perform the request operation.",   "Target": null,   "Details": [
    {
      "Message": "The service does not have access to  '/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted' Key Vault. Please make sure that you have  granted necessary permissions to the service to perform the request operation."
    },
    {
      "Code": "BadRequest"
    },
    {
      "ErrorEntity": {
        "ExtendedCode": "59716",
        "MessageTemplate": "The service does not have access to '{0}' Key Vault. Please make sure that you have granted necessary permissions to the service to perform  the request operation.",
        "Parameters": [          "/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted"
        ],
        "Code": "BadRequest",
        "Message": "The service does not have access to  '/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted' Key Vault. Please make sure that you have  granted necessary permissions to the service to perform the request operation."
      }
    }   ],   "Innererror": null }' At line:1 char:1
+ New-AzureRmResourceGroupDeployment -Name redacted -ResourceGroupName  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet New-AzureRmResourceGroupDeployment : 9:54:31 PM - Template output evaluation skipped: at least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. At line:1 char:1
+ New-AzureRmResourceGroupDeployment -Name redacted -ResourceGroupName  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet New-AzureRmResourceGroupDeployment : 9:54:31 PM - Template output evaluation skipped: at least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. At line:1 char:1
+ New-AzureRmResourceGroupDeployment -Name redacted -ResourceGroupName  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet

I have created a web app and want to bind an SSL certificate stored as a secret from Azure Keyvault. At first, I have created a self-signed certificate and uploaded it to keyvault as a 'secret'. From the Azure Active Directory, I have created a web app and used the application ID to grant access to key vault.

Following deployment template was used:

Azure RM template for deploying web app certificate from keyvault

2
  • Have you followed that full steps from that Azure RM template link you provided? or just deploy the templates? Jun 27, 2018 at 2:48
  • I have followed complete steps. Jun 27, 2018 at 10:17

4 Answers 4

6

It seems that Resource Provider has no permission to access the Key Vault.

By default, 'Microsoft.Azure.WebSites' Resource Provider (RP) doesn't have access to the Key Vault specified in the template hence you need to authorize it by executing the following PowerShell commands before deploying the template.

The RP requires read access to KeyVault. ‘abfa0a7c-a6b6-4736-8310-5855508787cd’ is the RP service principal name and it remains same for all Azure subscriptions.

Login-AzureRmAccount Set-AzureRmContext -SubscriptionId AZURE_SUBSCRIPTION_ID Set-AzureRmKeyVaultAccessPolicy -VaultName KEY_VAULT_NAME -ServicePrincipalName abfa0a7c-a6b6-4736-8310-5855508787cd -PermissionsToSecrets get

Here is a similar case.

4
  • I have created a App service and registered in Active Directory. Then, ran the above commands to login to azure subscription, set the subscription (where keyvault exists). I got the Application ID of the registered app service and then set access policy on the key vault. Then, ran the template New-AzureRmResourceGroupDeployment -Name ssl -ResourceGroupName ssl-rg -TemplateFile C:\Template\azuredeploy.json -TemplateParameterFile C:\Template\azuredeploy.parameters.json Jun 27, 2018 at 10:20
  • 1
    I mean the " abfa0a7c-a6b6-4736-8310-5855508787cd " is the global uniqueness of the application ID of "Microsoft.Azure.WebSites". You should use this ID in the commands. Jun 29, 2018 at 5:42
  • Won't using " abfa0a7c-a6b6-4736-8310-5855508787cd " mean that any web app (not just mine) will have access to the keyvault?
    – user648931
    Oct 29, 2018 at 22:37
  • 1
    @user648931, no, the "abfa0a7c-a6b6-4736-8310-5855508787cd" just represent the service principal of 'Microsoft.Azure.WebSites' Resource Provider (RP). It happens the RP need access the Key Vault. Oct 29, 2018 at 23:46
2

I found that I was using wrong application ID. The following step is the right one

Run the following command and replace application ID from the output Get-AzureRmADServicePrincipal -SearchString "Microsoft.Azure.WebSites"

Mostly likely application ID would still be the same.

Set-AzureRmKeyVaultAccessPolicy -VaultName KEY_VAULT_NAME -ServicePrincipalName abfa0a7c-a6b6-4736-8310-5855508787cd -PermissionsToSecrets get

I created an AppService and replaced abfa0a7c-a6b6-4736-8310-5855508787cd with application ID of my AppService which was wrong.

1
  • 1
    -SearchString does not return any results for me. Searching for -ServicePrincipleName however, returns the service principle with ID abfa0a7c-a6b6-4736-8310-5855508787cd, as @doubledecker mentioned. Get-AzureRmADServicePrincipal -ServicePrincipalName "Microsoft.Azure.WebSites"
    – tones
    Oct 31, 2018 at 3:41
1

not a direct answer but will surely help

#Microsoft Azure App Service
#Name: Microsoft Azure WebSites    
$AppServicePrincipalId = "abfa0a7c-a6b6-4736-8310-5855508787cd"
$KeyVaultSecretsUserRoleId = "4633458b-17de-408a-b874-0445c86b69e6"
$AppServicePrincipalObjectId = az ad sp show --id $AppServicePrincipalId --query objectId
az role assignment create --assignee-object-id $AppServicePrincipalObjectId --role $KeyVaultSecretsUserRoleId --scope $keyVaultScope --subscription $subscriptionName --assignee-principal-type "ServicePrincipal"


az webapp config hostname add --webapp-name $webAppName --resource-group $resourceGroupName --hostname $hostname
$sslResult = (az webapp config ssl import --resource-group $resourceGroupName --name $webAppName --key-vault $keyVaultName --key-vault-certificate-name $certificateName | convertfrom-json)
az webapp config ssl bind --certificate-thumbprint $sslResult.thumbprint --ssl-type SNI --name $webAppName --resource-group $resourceGroupName
0

I was not able to add the policies through the Set-AzureRmKeyVaultAccessPolicy command due to an error in the console.

I was however able to resolve the issue through the Azure Web Interface by opening the KeyVault Access Control(IAM) and adding Key Vault Reader and Key Vault Secrets User roles to Microsoft.Azure.Websites

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.