As part of product integration workflow, we want to create a "Volume Group Disk" using "Disk Recovery Point". The operation is performed using golang sdk. The SDK uses following API to perform the operation.
- Create a new Volume Disk: https://developers.nutanix.com/api-reference?namespace=storage&version=v4.0.a3
Workflow:
- Create "Virtual Machine" Recovery Point. Capture VM & Disk Recovery Point EXT IDs from response.
- Using the captured Disk Recovery Point EXT ID, create Volume Group Disk.
Issue:
- Step #2 in above workflow errors out with Authorization Error when invoked with user having custom role.
- Response: {5013 Operation failed {"data":{"error":[{"message":"Failed to authorize the request due to The request http://172.30.30.15/api/volumes/v4.1/config/volume-groups/19513a28-1f19-457b-55cd-dae3d781c540/disks is not authorized from IAM","code":"PLAT-10007","locale":"en_US","errorGroup":"RBAC_AUTHORIZATION_ERROR","severity":"ERROR","$objectType":"volumes.v4.error.AppMessage"}],"$errorItemDiscriminator":"List<volumes.v4.error.AppMessage>","$objectType":"volumes.v4.error.ErrorResponse"},"$dataItemDiscriminator":"volumes.v4.error.ErrorResponse"}}
- The same API works when invoked with user having "Super Admin" role.
Custom Role & Authorization Policy Details
Below are the custom role & authorization policy details used.
Custom Role Definition: The custom role has following permissions.
| Role | Permissions |
|---|---|
| AHV VM Recovery Point | - Create AHV VM Recovery Point - Delete AHV VM Recovery Point - Restore AHV VM Recovery Point - View AHV VM Recovery Point |
| Volume Group | - Associate Volume Group Categories - Attach Volume Group To AHV VM - Attach Volume Group To External iSCSI Client - Attach Volume Group To External NVMF Client - Create Volume Group - Create Volume Group Disk - Delete Volume Group - Delete Volume Group Disk - Detach Volume Group From AHV VM - Detach Volume Group From External iSCSI Client - Detach Volume Group From External NVMF Client - Disassociate Volume Group Categories - Revert Volume Group - Update Connections with Direct-attach AHV VMs - Update Connections with External iSCSI Clients - Update Volume Group - Update Volume Group Categories - Update Volume Group Details - Update Volume Group Disk - Update Volume Group Virtual Disks - View Volume Group - View Volume Group Category Associations - View Volume Group Details - View Volume Group Disk Stats - View Volume Group Disks - View Volume Group iSCSI Attachments - View Volume Group Metadata - View Volume Group NVMF Attachments - View Volume Group Stats - View Volume Group VM Attachments |
| VPC | View VPC |
| Cluster | View Cluster |
| Disk | - View Disk - View Disk Stats - Delete Disk |
| Host | View Host |
| Recovery Point | - Compute Changed Regions Virtual Machine Recovery Point - Create Recovery Point - Delete Recovery Point - Discover Cluster Recovery Point - Restore Recovery Point - View Recovery Point - View Virtual Machine Recovery Point - View Virtual Machine Recovery Point VSS Metadata |
| Storage Container | - Mount Storage Container Datastore - Unmount Storage Container Datastore - Update Container Disks - Update Container Volume Group - Update Storage Container - View Storage Container - View Storage Container Datastore - View Storage Container Stats |
| Storage Policy | - View Storage Policy |
| VM Recovery Point | View VM Recovery Point |
Authorization Policy: The custom role has following permissions.
| Object | Scope |
|---|---|
| Floating IP | All Floating IP |
| Storage Container | All Storage Container |
| Distributed Virtual Switch | All Distributed Virtual Switch |
| Recovery Point | On Cluster: All Clusters |
| Host | All Host |
| VPC | All VPC |
| Resource Type | All Resource Type |
| Network Group | All Network Group |
| VM Recovery Point | All VM Recovery Point |
| NTNX Meta API | All NTNX Meta API |
| AHV VM | All AHV VM |
| Project | All Project |
| Volume Group | All Volume Group |
| Cluster | All Cluster |
| iSCSI Client | On Cluster: All Clusters |
| Disk | On Cluster: All Clusters |
| Subnet | All Subnet |
| Category | All Category |
| AHV VM Recovery Point | All AHV VM Recovery Point |
| Automatic Access | llow users access to entities created by them. |
Need help in identifying the issue and mechanisms to resolve it.