Resolved

Azure Key Vault lacks SetRotationPolicy permission for key rotation

Azure
Key Vault
Terraform
Security
IAM
DevOps
Infrastructure
Encryption

Terraform deployment fails with 'current client lacks permissions to create Key Rotation Policy' error | Service principal missing 'SetRotationPolicy' permission in Key Vault access policy

Resolving Azure Key Vault Key Rotation Policy Permissions

Issue

Terraform deployment failed while attempting to create a Key Vault key rotation policy, resulting in an error indicating that the service principal lacked the necessary permissions to set the rotation policy. Specifically, the error was:

current client lacks permissions to create Key Rotation Policy

This occurred when attempting to configure automatic rotation for the tfstate-encryption-key used in the backend infrastructure.

Culprit

The Key Vault access policy was configured with read permissions for rotation policies (GetRotationPolicy) but did not include the required SetRotationPolicy permission. Azure enforces explicit permission grants for key rotation operations, and the absence of SetRotationPolicy prevented the Terraform deployment from executing the rotation policy block.

Solution

Updated Access Policy

The access policy for the Key Vault was updated to include the SetRotationPolicy permission, ensuring that the service principal had the necessary permissions to manage key rotation policies. This change allowed Terraform to successfully configure automatic key rotation with compliance requirements such as:

  • 90-day automatic rotation
  • 30-day advance notification
  • Banking-grade security compliance

Outcome: The Terraform deployment completed successfully, and key rotation policies were applied as configured, maintaining compliance with security and audit requirements.