Hi I am creating vault back up for postgres database in azure. I deployed my terraform scripts as below.
resource "azurerm_data_protection_backup_vault" "abc-backup-vault" {
name = "abc-backup-vault"
resource_group_name = "rg-al-prod-we"
location = "West Europe"
datastore_type = "VaultStore"
redundancy = "LocallyRedundant"
identity {
type = "SystemAssigned"
}
}
Below is vault policy
resource "azurerm_data_protection_backup_policy_postgresql" "abc-backup-vault-policy" {
name = "abc-backup-vault-policy"
resource_group_name = "rg-al-prod-we"
vault_name = azurerm_data_protection_backup_vault.abc-backup-vault.name
backup_repeating_time_intervals = [
"R/2023-08-07T01:00:00+00:00/P1W",
"R/2023-08-08T01:00:00+00:00/P1W",
"R/2023-08-02T01:00:00+00:00/P1W",
"R/2023-08-03T01:00:00+00:00/P1W",
"R/2023-08-04T01:00:00+00:00/P1W"
]
default_retention_duration = "P4M"
}
Below is vault instance
resource "azurerm_data_protection_backup_instance_postgresql" "abc-backup-vault-backup-instance" {
name = "abc-backup-vault-backup-instance"
location = "West Europe"
vault_id = azurerm_data_protection_backup_vault.abc-backup-vault.id
database_id = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg-al-prod-we/providers/Microsoft.DBforPostgreSQL/servers/sqldb-abc-prod.postgres.database.azure.com/databases/abcProd"
backup_policy_id = azurerm_data_protection_backup_policy_postgresql.abc-backup-vault-policy.id
database_credential_key_vault_secret_id = "https://kv-abc-prodction.vault.azure.net/secrets/abc-prod-connectionstring/c80bcd5eaebf4cf9bf8e6d80efc50a92"
}
I created key vault manually and added db conmnection string into kv as secrete. I am using below script to assign roles.
resource "mskadmiralv2_azure_resource_role_assignment" "abc-backup-vault-role" {
object_id = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id
product_code = "abc"
resource_id = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg-al-prod-we/providers/Microsoft.DBforPostgreSQL/servers/psqldb-abc-prod/"
role_id = "5e467623-bb1f-42f4-a55d-6e525e11384b"
}
resource "mskadmiralv2_azure_resource_role_assignment" "abc-key-vault-role" {
object_id = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id
product_code = "abc"
resource_id = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg_abc-kv-abc-prodction_mkv/providers/Microsoft.KeyVault/vaults/kv-abc-prodction"
role_id = "acdd72a7-3385-48ef-bd42-f606fba81ae7"
}
resource "mskadmiralv2_azure_resource_role_assignment" "abc-key-vault-reader-role" {
object_id = azurerm_data_protection_backup_vault.abc-backup-vault.identity.0.principal_id
product_code = "abc"
resource_id = "/subscriptions/a188bdc0-0801-43d2-861c-e4b5bd5dbdb0/resourceGroups/rg_abc-kv-abc-prodction_mkv_kv-abc-prodction_mkv/providers/Microsoft.KeyVault/vaults/kv-abc-prodction"
role_id = "21090545-7ca7-4776-b22c-e363652d74d2"
}
After deploying/mapping above roles I am getting error
UserErrorMissingPermissionsOnSecretStore: Missing permissions to read the Key vault secrets.
May I know am I missing any roles still? Can someone please help me to create backup vault? Any help would be appreciated. Than you.
I tried to check with accessing the secret for my postgress db I was able to access it with all the necessary permissions.
It appears that you are encountering a "UserErrorMissingPermissionsOnSecretStore"
error, indicating that the necessary permissions to read the Key Vault secrets are missing.
To resolve this issue, you need to ensure that the principal assigned to the backup vault has the appropriate permissions on the Key Vault. In your case, you have already assigned the "abc-key-vault-role"
and "abc-key-vault-reader-role"
roles to the principal, but it seems that these roles do not have sufficient permissions to read the secrets.
To grant the necessary permissions, you can try assigning the Key Vault Secrets User role to the principal on the Key Vault. Even if you have the Key Vault Secrets User role vault configuration set to Vault policy you will get the same error. Make sure to set the Key vault access configuration RBAC, not the vault policy.
The Reader role provides read access to all the secrets in the Key Vault which does not work for RBAC or Access policy.
My terraform configuration
data "azurerm_client_config" "current" {}
data "azurerm_resource_group" "example" {
name = "v-bolliv"
}
data "azurerm_key_vault" "example"{
name = "bollivkeyvault"
resource_group_name = data.azurerm_resource_group.example.name
}
resource "random_password" "postgress-pass" {
length = 15
min_special = 5
}
resource "azurerm_postgresql_server" "example" {
name = "postgresqlsbvk01"
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
sku_name = "B_Gen5_2"
storage_mb = 5120
backup_retention_days = 7
geo_redundant_backup_enabled = false
auto_grow_enabled = true
administrator_login = "psqladmin"
administrator_login_password = "H@Sh1CoR3!"
version = "9.5"
ssl_enforcement_enabled = true
}
resource "azurerm_postgresql_firewall_rule" "example" {
name = "AllowAllWindowsAzureIpsvksb01"
resource_group_name = data.azurerm_resource_group.example.name
server_name = azurerm_postgresql_server.example.name
start_ip_address = "0.0.0.0"
end_ip_address = "0.0.0.0"
}
resource "azurerm_postgresql_database" "example" {
name = "postgresqldbvksb01"
resource_group_name = data.azurerm_resource_group.example.name
server_name = azurerm_postgresql_server.example.name
charset = "UTF8"
collation = "English_United States.1252"
}
resource "azurerm_data_protection_backup_vault" "example" {
name = "dataprotectionsbvk01"
resource_group_name = data.azurerm_resource_group.example.name
location = data.azurerm_resource_group.example.location
datastore_type = "VaultStore"
redundancy = "LocallyRedundant"
identity {
type = "SystemAssigned"
}
}
resource "azurerm_data_protection_backup_policy_postgresql" "example" {
name = "policypostvksb01"
resource_group_name = data.azurerm_resource_group.example.name
vault_name = azurerm_data_protection_backup_vault.example.name
backup_repeating_time_intervals = ["R/2021-05-23T02:30:00+00:00/P1W"]
default_retention_duration = "P4M"
}
resource "azurerm_key_vault_access_policy" "abc-key-vault-reader-policy" {
key_vault_id = "/subscriptions/b83c1ed3-0000-0000-b5ba-2b83a0740000/resourceGroups/v-bolliv-/providers/Microsoft.KeyVault/vaults/bollivkeyvault"
tenant_id = "72f988bf-0000-0000-0000-2d7cd010000"
object_id = azurerm_data_protection_backup_vault.example.identity.0.principal_id
secret_permissions = [
"Get",
"List"
]
}
resource "azurerm_role_assignment" "example" {
scope = azurerm_postgresql_server.example.id
role_definition_name = "Reader"
principal_id = azurerm_data_protection_backup_vault.example.identity.0.principal_id
}
resource "azurerm_data_protection_backup_instance_postgresql" "example" {
name = "examplesbvk01"
location = data.azurerm_resource_group.example.location
vault_id = azurerm_data_protection_backup_vault.example.id
database_id = azurerm_postgresql_database.example.id
backup_policy_id = azurerm_data_protection_backup_policy_postgresql.example.id
database_credential_key_vault_secret_id = azurerm_key_vault_secret.example.versionless_id
}
resource "azurerm_key_vault_secret" "example" {
name = "examplesbvk01"
value = "Server=${azurerm_postgresql_server.example.name}.postgres.database.azure.com;Database=${azurerm_postgresql_database.example.name};Port=5432;User Id=psqladmin@${azurerm_postgresql_server.example.name};Password=H@Sh1CoR3!;Ssl Mode=Require;"
key_vault_id = data.azurerm_key_vault.example.id
}
Output:
Terraform configuration to check the Connection sting which was passed as secret.
Code:
data "azurerm_key_vault_secret" "example" {
name = "webapp"
key_vault_id = "/subscriptions/b83c1ed3-0000-0000-0000-2b83a070000/resourceGroups/v-bolliv/providers/Microsoft.KeyVault/vaults/bollivkeyvault"
}
output "secret_value" {
value = data.azurerm_key_vault_secret.example.value
sensitive = true
}