Closed slavina-rumenova closed 2 years ago
Hello, slavina-rumenova ! 🖐
Thank you for submitting an issue for this provider. The issue will now enter into the issue lifecycle.
If you want to contribute to this project, please review the contributing guidelines and information on submitting pull requests.
This does seem the be related the StorageProfile
privileges per the debug.
Are you running the plan under the context of administrator@vsphere.local
or a user assigned the Administrator role?
If neither, can you provide a detailed list of the privileges or default role assigned to the account under which the plan is configured?
Ryan Johnson Staff II Solutions Architect | VMware, Inc.
I'm running the plan under a user assigned the Administrator role via an AD group (permissions are handled by our vcenter admins via AD groups and my user is part of a group which should have Administrator rights on all VMs in the DC).
Here's a list of all the rights that I have:
Alarm.Acknowledge
Datastore.AllocateSpace
Datastore.Browse
Datastore.DeleteFile
Datastore.FileManagement
Datastore.UpdateVirtualMachineFiles
Datastore.UpdateVirtualMachineMetadata
Folder.Create
Folder.Delete
Folder.Move
Folder.Rename
Global.SetCustomField
InventoryService.Tagging.ObjectAttachable
Network.Assign
Resource.ApplyRecommendation
Resource.AssignVAppToPool
Resource.AssignVMToPool
StoragePod.Config
StorageProfile.Update
StorageProfile.View
StorageViews.View
System.Anonymous
System.Read
System.View
VApp.ApplicationConfig
VApp.AssignResourcePool
VApp.AssignVApp
VApp.AssignVM
VApp.Clone
VApp.Create
VApp.Delete
VApp.Export
VApp.ExtractOvfEnvironment
VApp.Import
VApp.InstanceConfig
VApp.ManagedByConfig
VApp.Move
VApp.PowerOff
VApp.PowerOn
VApp.Rename
VApp.ResourceConfig
VApp.Suspend
VApp.Unregister
VirtualMachine.Config.AddExistingDisk
VirtualMachine.Config.AddNewDisk
VirtualMachine.Config.AddRemoveDevice
VirtualMachine.Config.AdvancedConfig
VirtualMachine.Config.Annotation
VirtualMachine.Config.CPUCount
VirtualMachine.Config.ChangeTracking
VirtualMachine.Config.DiskExtend
VirtualMachine.Config.DiskLease
VirtualMachine.Config.EditDevice
VirtualMachine.Config.HostUSBDevice
VirtualMachine.Config.ManagedBy
VirtualMachine.Config.Memory
VirtualMachine.Config.MksControl
VirtualMachine.Config.QueryFTCompatibility
VirtualMachine.Config.QueryUnownedFiles
VirtualMachine.Config.RawDevice
VirtualMachine.Config.ReloadFromPath
VirtualMachine.Config.RemoveDisk
VirtualMachine.Config.Rename
VirtualMachine.Config.ResetGuestInfo
VirtualMachine.Config.Resource
VirtualMachine.Config.Settings
VirtualMachine.Config.SwapPlacement
VirtualMachine.Config.ToggleForkParent
VirtualMachine.Config.Unlock
VirtualMachine.Config.UpgradeVirtualHardware
VirtualMachine.GuestOperations.Execute
VirtualMachine.GuestOperations.Modify
VirtualMachine.GuestOperations.ModifyAliases
VirtualMachine.GuestOperations.Query
VirtualMachine.GuestOperations.QueryAliases
VirtualMachine.Hbr.ConfigureReplication
VirtualMachine.Hbr.MonitorReplication
VirtualMachine.Hbr.ReplicaManagement
VirtualMachine.Interact.AnswerQuestion
VirtualMachine.Interact.Backup
VirtualMachine.Interact.ConsoleInteract
VirtualMachine.Interact.CreateScreenshot
VirtualMachine.Interact.CreateSecondary
VirtualMachine.Interact.DefragmentAllDisks
VirtualMachine.Interact.DeviceConnection
VirtualMachine.Interact.DisableSecondary
VirtualMachine.Interact.DnD
VirtualMachine.Interact.EnableSecondary
VirtualMachine.Interact.GuestControl
VirtualMachine.Interact.MakePrimary
VirtualMachine.Interact.Pause
VirtualMachine.Interact.PowerOff
VirtualMachine.Interact.PowerOn
VirtualMachine.Interact.PutUsbScanCodes
VirtualMachine.Interact.Record
VirtualMachine.Interact.Replay
VirtualMachine.Interact.Reset
VirtualMachine.Interact.SESparseMaintenance
VirtualMachine.Interact.SetCDMedia
VirtualMachine.Interact.SetFloppyMedia
VirtualMachine.Interact.Suspend
VirtualMachine.Interact.SuspendToMemory
VirtualMachine.Interact.TerminateFaultTolerantVM
VirtualMachine.Interact.ToolsInstall
VirtualMachine.Interact.TurnOffFaultTolerance
VirtualMachine.Inventory.Create
VirtualMachine.Inventory.CreateFromExisting
VirtualMachine.Inventory.Delete
VirtualMachine.Inventory.Move
VirtualMachine.Inventory.Register
VirtualMachine.Inventory.Unregister
VirtualMachine.Namespace.Event
VirtualMachine.Namespace.EventNotify
VirtualMachine.Namespace.Management
VirtualMachine.Namespace.ModifyContent
VirtualMachine.Namespace.Query
VirtualMachine.Namespace.ReadContent
VirtualMachine.Provisioning.Clone
VirtualMachine.Provisioning.CloneTemplate
VirtualMachine.Provisioning.CreateTemplateFromVM
VirtualMachine.Provisioning.Customize
VirtualMachine.Provisioning.DeployTemplate
VirtualMachine.Provisioning.DiskRandomAccess
VirtualMachine.Provisioning.DiskRandomRead
VirtualMachine.Provisioning.FileRandomAccess
VirtualMachine.Provisioning.GetVmFiles
VirtualMachine.Provisioning.MarkAsTemplate
VirtualMachine.Provisioning.MarkAsVM
VirtualMachine.Provisioning.ModifyCustSpecs
VirtualMachine.Provisioning.PromoteDisks
VirtualMachine.Provisioning.PutVmFiles
VirtualMachine.Provisioning.ReadCustSpecs
VirtualMachine.Replication.com.vmware.vcDr.Protect
VirtualMachine.Replication.com.vmware.vcDr.Unprotect
VirtualMachine.State.CreateSnapshot
VirtualMachine.State.RemoveSnapshot
VirtualMachine.State.RenameSnapshot
VirtualMachine.State.RevertToSnapshot
StorageProfile.[View|Update]
are granted, this should be enough, right?
You may wish to check against https://github.com/hashicorp/terraform-provider-vsphere/issues/1666 which has a list of privileges used for r/virtual_machine
resource on one user's environment.
Ryan Johnson Staff II Solutions Architect | VMware, Inc.
I do have both privileges mentioned in the issue that were the issue:
VirtualMachine.Config.SwapPlacement
StorageProfile.View
The only ones that I am missing compared to the other user are:
Host.Local.CreateVM
Host.Local.DeleteVM
Host.Local.ReconfigVM
However, as they are not related to StorageProfile, I doubt this is the issue
Hi @slavina-rumenova - are you still experiencing this issue?
Ryan Johnson Senior Staff Solutions Architect | Product Engineering @ VMware, Inc.
No, it turned out to be permissions after all. Even though I had StorageProfile.[View|Update] on a second level sphere element, that's not enough. One needs the StorageProfile permissions on the top level vsphere element in the hierarchy. After I was granted this, all worked fine.
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Community Guidelines
Terraform
1.1.9
Terraform Provider
2.1.1
VMware vSphere
7.0.2
Description
VM creation fails due to missing permissions on queryAssociatedProfile when triggered by an vsphere admin user:
Error: error reconfiguring virtual machine: error processing disk changes post-clone: disk.0: ServerFaultCode: NoPermission: RESOURCE (vm-41690:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-41690), ACTION (PolicyIDByVirtualDisk)
I found a couple of github issues, referring to the same error message, which suggested that one requires StorageProfile.View & StorageProfile.Update permissions. My user does, however have those permission, as well as administrator privileges on the vsphere cluster. In addition, there are no Storage Profiles configured, just the default one is used. Does anyone have an idea on why this is still failing?
Affected Resources
resource/vsphere_virtual_machine
Terraform Configuration
Debug Output
Panic Output
No response
Expected Behavior
VM should create successfully
Actual Behavior
VM creation fails post-clone
References
974