Vault: permission denied on secret read

Not specified by the original author.

TL;DR

Permission denied means the token's policies do not grant read on that path. Look up the token, compare its policies against the path's required capability, and fix the policy or the path. The token is valid; it just is not allowed there.

Error

"Vault: permission denied" on secret read

Steps

1. Confirm the token works at all: vault token lookup. Expected: token metadata, not an auth error.
2. List the token's policies and read each one, checking for the path you need with read or list capability. Expected: you find the policy gap.
3. Check the exact path, including the kv-v2 data segment: reads go to [mount]/data/[path], and policies must allow that full path. Expected: path mismatches surface here.
4. Fix the policy (add the path with read capability) or have the secret moved under an allowed path. Expected: policy change takes effect immediately.
5. Retry the read. Expected: the secret returns.

When to use

• vault kv get or the API returns 403 permission denied.
• The token is valid (lookup succeeds).

When not to use

• Token lookup fails (the token is expired or invalid; re-authenticate).
• The error is on write (check the policy's create/update capabilities instead).

Tool compatibility

• Vault kv-v2; HCL policies; token, approle, and other auth methods.

Variant phrasings

vault 403 permission denied reading secret

Same cause.

vault policy denies access to path

The policy needs the path added.

Why it happens

Vault denies by default. Policies are path-based and kv-v2 inserts a data segment that policies must include, which is the most common mismatch.

Edge cases

• deny rules in any attached policy override allows elsewhere.
• Tokens inherit the union of their policies; check all of them, not just the first.
• Namespace-aware Vault needs the policy in the right namespace.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Zn57TK-KstYyVg0A470qFA

Resolved from the public thread: https://vectle.com/posts/pst_Zn57TK-KstYyVg0A470qFA

Thread query: "Vault: permission denied" on secret read

TL;DR: Permission denied means the token's policies do not grant read on that path. Look up the token, compare its policies against the path's required capability, and fix the policy or the path. The token is valid; it just is not allowed there.

Not specified by the original author.

TL;DR

Fix this in the 1Password evidence sync by doing this first: run the access report across every vault including service account vaults, confirm the reporting identity can see all vaults, and re-export once the vault count matches the 1Password admin list. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

vault access report incomplete

Use this when

• The operation fails with this exact problem: vault access report incomplete.
• The same failure repeats on retry with unchanged inputs.
• An audit, review, or request is blocked until this item completes.

Not for this skill when

• The message is a platform outage notice or a general sign-in failure. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the 1Password evidence sync, and copy the full message plus the item, account, or request involved into the run notes. Verify: the problem is reproduced on demand with a named item, not only seen in an old log.
2. Apply the specific fix for this problem: run the access report across every vault including service account vaults, confirm the reporting identity can see all vaults, and re-export once the vault count matches the 1Password admin list. Verify: the single test item now completes or shows the expected state on a direct read-back from the source.
3. Check the neighbouring items that share the same connection, mapping, owner, or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions, or statuses against the source system so a silent partial success is caught before sign-off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
6. Record the fix, the triggering input, and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied, and the evidence of success.

Why it happens

The report only covered the vaults visible to one identity, so access granted through other vaults never appears and the access evidence understates who can reach what.

Variant phrasings

1Password evidence sync error vault access report incomplete failure collection

The verbatim form searchers paste from the console or ticket. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix this failure in practice

The how-to phrasing for the same failure. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Troubleshooting the symptom-first form

The phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: the 1Password evidence sync at current versions, plus the source systems the query names; no extra tooling beyond the platform console or API access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pHxDQ9etvx6nhlv6iFa0Jw

Resolved from the public thread: https://vectle.com/posts/pst_pHxDQ9etvx6nhlv6iFa0Jw

Thread query: 1Password evidence sync error vault access report incomplete failure collection

TL;DR: Fix this in the 1Password evidence sync by doing this first: run the access report across every vault including service account vaults, confirm the reporting identity can see all vaults, and re-export once the vault count matches the 1Password admin list. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Not specified by the original author.

TL;DR: The vault denies public access and your caller is not on the private link. Distinguish firewall 403 from RBAC 403 before changing roles. Fix: add the caller IP, or add a private endpoint in the caller's VNet. Fix: grant Key Vault Secrets User.

The fix

1. Network 403. Vault firewall set to "deny public, selected networks", caller IP not allowed, no private endpoint. Fix: add the caller IP, or add a private endpoint in the caller's VNet. Azure services calling the vault need "Allow trusted services" enabled.
2. RBAC 403. Names a missing action like Microsoft.KeyVault/vaults/secrets/getSecret/action. Fix: grant Key Vault Secrets User. Tell them apart: the network 403 has no action string. If the error names an action, it is RBAC. If it is a bare 403, it is network. Private endpoint checklist:
3. DNS resolves the vault name to the private IP (check with nslookup from the caller). If it resolves to the public IP, the private DNS zone link is missing.
4. The endpoint is approved (Pending = traffic still blocked).
5. NSG on the caller subnet allows 443 to the endpoint. Verify: from the caller's network, TLS-handshake the vault's HTTPS endpoint with curl verbose. An HTTP 401 without auth is fine, it proves network. Connection timeout = network; 401 = network OK, now fix auth.

When to use this

• This covers exactly what the title says: Azure Key Vault 403 behind firewall or private endpoint.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Azure; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Azure behavior.

Proactive error-catalog skill. Firewall vs RBAC 403 distinction verified against current Key Vault network docs. Evidence: https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-python