0

I am facing an issue when trying to connect to a VM using bastion. I want to use the SSH key that is stored in a keyvault (only accessible through a private endpoint).

The bastion, the VM and the keyvault are all in the same VNET. The portal tells me I don't have list access but that is not true (Attached Image). The private endpoint has a private dns entry and a private IP. The private dns zone has a VNET-link to the VNET.

Is there something I am missing? Is this not the way to go?

enter image description here

Imran
  • 3,875
  • 2
  • 3
  • 12
MathiasJ
  • 1
  • 1

1 Answers1

0

I tried to reproduce the same in my environment I got the same error like below:

enter image description here

This issue occurs if your key vault does not have access policies permission make sure to add access policies like below:

In your keyvault -> Access policies -> create -> try to give permission to all keys

enter image description here . enter image description here

Enter the name of the user, app, or service principal in the search field and select the appropriate to access policy and review + create like below:

enter image description here

Now, check the policy is listed which users are added here can be able to access the bastion

enter image description here

Now Bastion is connected successfully like below:

enter image description here

Reference:

Connect to a Windows VM using SSH - Azure Bastion | Microsoft Learn

Imran
  • 3,875
  • 2
  • 3
  • 12
  • Hello Imran, Thank you for your time spent on this issue. I am positive that this is not a permissions issue. My user has permissions on keys, secrets and certs of the kv (double checked). Adding my ip to the kv firewall (kv -> settings -> networking) fixes the issue so that proves it wasn't a permissions issue as well. I suppose bastion is not capable of using the private link to the kv to get the ssh key which is a shame. – MathiasJ May 10 '23 at 11:34
  • It would NOT benefit the community because that is not the answer that fixes my problem (like I explained in my previous comment on this issue) – MathiasJ May 10 '23 at 12:36