Azure Kubernetes Service
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
AKS cost-analysis-agent pod cannot attach pvc
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(102.4, 53%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
Chalvatzis, Michael
0
Reputation points
We see the following K8s event:
Note: AttachVolume.Attach failed for volume "pvc-xxxxxxxx" : rpc error: code = Internal desc = Attach volume /subscriptions/xxxxxxxx/resourceGroups/xxxxxxx-aksmanaged/providers/Microsoft.Compute/disks/pvc-xxxxxxxx to instance aks-sys-xxxxxxxx-vmss000000 failed with PUT http://localhost:7788/subscriptions/xxxxxxx/resourceGroups/xxxxxxx-aksmanaged/providers/Microsoft.Compute/virtualMachineScaleSets/aks-sys-xxxxxxxx-vmss/virtualMachines/0
RESPONSE 403: 403 Forbidden ERROR CODE: LinkedAuthorizationFailed
{ "error": { "code": "LinkedAuthorizationFailed", "message": "The client 'xxxxxxx' with object id 'xxxxxxx' has permission to perform action 'Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write' on scope /subscriptions/xxxxxxxx-f8f7-4b
Question: How can we see the full "error" message? The interesting part is cut and we cannot evaluate the real problem
Azure Kubernetes Service
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 80%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
Shraddha Pandey 540 Reputation points Microsoft External Staff Moderator2025-12-11T15:02:08.4133333+00:00 Hi @Chalvatzis, Michael ,
The error "LinkedAuthorizationFailed" with a 403 Forbidden response occurs when the AKS control plane's managed identity lacks permissions to attach the Azure disk (pvc-xxxxxxxx) to the VMSS instance in the aks-sys-xxxxxxxx-vmss scale set.
Root Cause
AKS uses a managed identity for CSI driver operations on managed disks. The client (object ID xxxxxxx) is denied the 'Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write' action on the VMSS scope due to missing role assignment.
Here are some troubleshooting steps you can try:
Grant the required role to the AKS cluster's identity on the MC_ resource group (xxxxxxx-aksmanaged):
- Get AKS identity principal ID
az aks show --resource-group xxxxxxx --name <aks-cluster-name> --query "identityProfile.kubeletidentity.objectId" -o tsv
- Assign "Virtual Machine Contributor" role to that principal ID on the MC_ RG
az role assignment create --assignee <principal-id> --role "Virtual Machine Contributor" --scope /subscriptions/xxxxxxxx/resourceGroups/xxxxxxx-aksmanaged.
- Verify with
az role assignment list --scope /subscriptions/xxxxxxxx/resourceGroups/xxxxxxx-aksmanaged --assignee <principal-id>. - Delete the pod/PVC, recreate, and monitor events via
kubectl describe pod.
Note: Ensure disks are created in the node resource group (not MC_) or use AKS-managed identity with Contributor on both MC_ and disk RGs during cluster upgrades.
Documents:
- https://computacionvinchi.blogspot.com/2025/02/azure-linkedauthorizationfailed-error.html
- https://v4.hkg1.meaqua.org/en-us/azure/aks/use-managed-identity?pivots=system-assigned
- https://v4.hkg1.meaqua.org/en-us/azure/role-based-access-control/role-assignments-cli
- https://portworx.com/blog/understand-resolve-warning-failed-attach-volume-warning-failed-mount-errors-kubernetes-azure/
- https://v4.hkg1.meaqua.org/en-us/troubleshoot/azure/azure-kubernetes/storage/fail-to-mount-azure-disk-volume
- https://stackoverflow.com/questions/62614458/permissions-error-when-attaching-azure-disk-to-aks-pod
I hope the above helps. Please let us know if you have any further questions on this.
Thank You!
-
Chalvatzis, Michael 0 Reputation points
2025-12-11T16:01:05.5533333+00:00 Hi,
thank you for your reply, but I would like to point out, that your statement:
"AKS uses a managed identity for CSI driver operations on managed disks. The client (object ID xxxxxxx) is denied the 'Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write' action on the VMSS scope due to missing role assignment."
is not correct!As I wrote, the event Note states that the used client has the permission to write, but the note gets cut and I do not understand where the issue is...
"error": "code": "LinkedAuthorizationFailed", "message": "The client 'xxxxxxx' with object id 'xxxxxxx' has permission to perform action Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write' on scope /subscriptions/xxxxxxxx-f8f7-4b ... (this part is missing!)
We use a userdefinedManagedIdentity. Might this cause trouble with the cost-analyzer?
-
Shraddha Pandey 540 Reputation points Microsoft External Staff Moderator
2025-12-12T09:53:51.22+00:00 Hi @Chalvatzis, Michael ,
Yes, using a User-Assigned Managed Identity (UAMI) can lead to a LinkedAuthorizationFailed error if the identity lacks the necessary permissions on all linked resources required for the operation, such as VMSS, disks, network, resource group, or subscription. This issue can also affect tools like a cost analyzer if they initiate ARM operations that need access across multiple resources.
LinkedAuthorizationFailedis an Azure RBAC error that appears when:- The identity does have permission on the target resource, but
- The operation also touches another linked resource, and the identity does not have sufficient rights there.
- The identity does have permission (here:
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write) on the VMSS scope. - But it does not have a required action on a linked resource in that same operation (for example a user‑assigned identity, disk, NIC, network profile, etc.). Typical missing actions in similar cases are things like
Microsoft.ManagedIdentity/userAssignedIdentities/assign/actionwhen a VMSS attaches a user-assigned identity.
Because you are using a user‑defined (user‑assigned) managed identity, the VMSS update or write operation usually needs:
- Permission on the VMSS itself (which you already have), and
- Permission to assign/use the user-assigned identity at its own resource scope.
Cost analyzers or automation that scale or modify the VMSS on your behalf will fail if the identity they run as does not have both sets of permissions; the identity type (user-assigned vs system-assigned) is not the fundamental problem, the missing RBAC access is.
Minimal setup that usually fixes this
On the VMSS (or its resource group):
Assign role: Virtual Machine Contributor
Principal: the identity used by the cost‑analyzer.
On the user‑assigned managed identity resource:
Assign role: Managed Identity Operator
Principal: the same identity used by the cost‑analyzer.
Documents:
Troubleshoot the LinkedAuthorizationFailed error code
I hope the above helps. Please let us know if you have any further questions on this.
Thank You!!
Sign in to comment
Sign in to answer