azure - 权限_拒绝 : Invalid permissions on the specified KeyVault

Question

com.databricks.common.client.DatabricksServiceHttpClientException:
PERMISSION_DENIED: Invalid permissions on the specified KeyVault https://azkv*.vault.azure.net/.
Wrapped Message:
  Status code 403,
  {"error":
    {"code":"Forbidden","message":
       "Caller is not authorized to perform action on resource.\r\n
        If role assignments, deny assignments or role definitions were changed recently, please observe propagation time.\r\n
        Caller: name=AzureDatabricks;appid=2vf8v4a6-3304-4ab8-85cb-cd0e6f879c1d;oid=4e924d0e-ad49-4acc-baec-6d612e920502;iss=https://sts.windows.net/552af62d-5878-4131-8695-1e87b0f89945/\r\n
        Action: 'Microsoft.KeyVault/vaults/secrets/getSecret/action'\r\n
        Resource: '/subscriptions/6b60a61d-3e92-4501-8794-fd7725066113/resourcegroups/streamproject/providers/microsoft.keyvault/vaults/azkv*/secrets/clientsecret'\r\n
        Assignment: (not found)\r\n
        DecisionReason: 'DeniedWithNoValidRBAC' \r\n
        Vault: azkv*;location=eastus\r\n",
      "innererror":{"code":"ForbiddenByRbac"}
    }
  }

我一直在尝试使用服务主体和 secret 范围将 ADLS 安装到 databricks。我似乎无法访问 key 保管库。

我该如何解决这个问题？

Answer 1

您必须在访问策略边栏选项卡中添加身份

然后您为 secret 范围设置所需的权限

稍后选择您的databrick对应的服务主体

然后您创建策略

希望这有帮助!