smom-dbis-138/docs/archive/status-reports/phase1-old/PERMISSIONS_AND_STATUS.md

Permissions and Status Report

Summary

✅ Completed

1. Genesis Upload to Storage: Successfully uploaded to Azure Storage
   • URL: https://azpcusvmbp7dfbc1.blob.core.windows.net/config/genesis-138.json
   • Method: Used storage account key (no special permissions needed)

⏳ Pending (Permissions Required)

1. Key Vault Upload

• Status: Blocked by firewall
• Error: ForbiddenByFirewall - Client address not authorized
• Current IP: 206.170.208.82 (IPv4)
• Solution Options:
  1. Add IP to Key Vault firewall rules
  2. Enable "Allow Azure Services" in Key Vault network settings
  3. Use Managed Identity from within Azure (VM, Function App, etc.)
  4. Use Azure Bastion or VPN to access from authorized network

Command to add IP (requires Key Vault Contributor role):

az keyvault network-rule add \
  --name az-p-wst-kv-secrets-001 \
  --ip-address 206.170.208.82

Or enable Azure Services:

az keyvault update \
  --name az-p-wst-kv-secrets-001 \
  --bypass AzureServices \
  --default-action Allow

2. Besu Node Configuration

• Status: Scripts ready, testing Azure Run Command
• Method: Using Azure VM Run Command (no SSH needed)
• Access: Requires "Virtual Machine Contributor" role or equivalent
• Current Status: Script created, testing execution

Required Permissions

For Genesis Upload

Storage Account

• ✅ No special permissions needed - Using storage account key
• Alternative: "Storage Blob Data Contributor" role

Key Vault

• ⏳ Key Vault Secrets Officer role
• ⏳ Network access (firewall rules or Azure Services bypass)

For Besu Configuration

Azure VM Run Command

• ⏳ Virtual Machine Contributor role (or equivalent)
• ⏳ Microsoft.Compute/virtualMachines/runCommand/action permission

Alternative: SSH Access

• ⏳ SSH access to VMs (private IPs require VPN/Bastion)
• ⏳ Sudo access on VMs

Current Access Status

VMs

• Nginx Proxy: ✅ Accessible via SSH (public IP: 20.160.58.99)
• Backend VMs: ⏳ Not accessible via SSH (private IPs, need VPN/Bastion)
• Azure Run Command: ⏳ Testing (should work with proper permissions)

Storage

• ✅ Accessible - Genesis uploaded successfully

Key Vault

• ⏳ Blocked - Firewall rules need configuration

Next Steps

1. Configure Key Vault Network Access:

   • Add current IP to firewall rules, OR
   • Enable Azure Services bypass

2. Complete Besu Configuration:

   • Verify Azure Run Command permissions
   • Execute configuration script
   • Verify all 5 nodes are running

3. Verify Deployment:

   • Check Besu logs
   • Test RPC endpoints
   • Verify genesis file loaded correctly

Commands to Fix Permissions

Key Vault - Add IP to Firewall

az keyvault network-rule add \
  --name az-p-wst-kv-secrets-001 \
  --ip-address 206.170.208.82

Key Vault - Enable Azure Services (Alternative)

az keyvault update \
  --name az-p-wst-kv-secrets-001 \
  --bypass AzureServices \
  --default-action Allow

Check Current Permissions

# Check role assignments
az role assignment list \
  --assignee $(az account show --query user.name -o tsv) \
  --all \
  --query "[?contains(roleDefinitionName, 'Key Vault') || contains(roleDefinitionName, 'Storage') || contains(roleDefinitionName, 'Virtual Machine')].{Role:roleDefinitionName,Scope:scope}" \
  -o table

# Check Key Vault network rules
az keyvault show \
  --name az-p-wst-kv-secrets-001 \
  --query "properties.networkAcls" \
  -o json

---

Status: Genesis uploaded to Storage. Key Vault and Besu configuration pending permissions/network access.