Add additional permissions to your Azure policy

Make sure that the following additional permissions are set up for the Azure credential used in Cloudera environment creation, in addition to what is documented in Azure permissions.

All of them are actions and must be granted within the scope of the resource group hosting the Cloudera environment:

"Microsoft.KeyVault/vaults/read", 
"Microsoft.KeyVault/vaults/write",
"Microsoft.KeyVault/vaults/deploy/action",
"Microsoft.Compute/diskEncryptionSets/read",
"Microsoft.Compute/diskEncryptionSets/write",
"Microsoft.Compute/diskEncryptionSets/delete",
"Microsoft.DBforPostgreSQL/servers/read",
"Microsoft.DBforPostgreSQL/servers/keys/write",
"Microsoft.KeyVault/vaults/accessPolicies/write"

note

When a user-supplied managed identity is created for Flexible Server encryption, the following permissions are not needed:

"Microsoft.KeyVault/vaults/accessPolicies/write" 
"Microsoft.KeyVault/vaults/write"

For more information, see Managed identity for encrypting Azure Database for PostgreSQL Flexible Server.

The following table describes why Cloudera needs these permissions:

Table 1.
Permission	Description
Microsoft.KeyVault/vaults/read and Microsoft.KeyVault/vaults/write	Microsoft.KeyVault/vaults/read is required to read the vaults. Without this, Cloudera cannot detect vaults in your subscription. Specifically, Cloudera must update the Key Vault access policy to add an entry for the DES SP. For this, Cloudera invokes an "update key vault" operation, which Azure implements as the following series of steps: Read Key Vault details, including its original access policy (Requires Microsoft.KeyVault/vaults/read). Add entry for DES SP. Write Key Vault details, including the updated access policy. In this step, Microsoft.KeyVault/vaults/write is required for adding an entry for the DES SP for the operations get, unwrap key, and wrap key.
Microsoft.KeyVault/vaults/write	This is required to update the access policies for the DES created in the vault.
Microsoft.KeyVault/vaults/deploy/action	This is required to create DES resources. Specifically, it’s required for DES SP creation (performed automatically alongside the DES creation) that will ultimately be used to access the Key Vault from the DES.
Microsoft.Compute/diskEncryptionSets/read	This is required to check for the existence of and fetch the properties and status of DES resources created by Cloudera.
Microsoft.Compute/diskEncryptionSets/write	This is required to create DES resources.
Microsoft.Compute/diskEncryptionSets/delete	This is required to delete the DES during environment termination.
Microsoft.DBforPostgreSQL/servers/keys/write and Microsoft.KeyVault/vaults/accessPolicies/write	This is required for setting up access policies and keys via an Azure Resource Manager template.