Skip to content

Provider Permission Missing

URI: https://docs.ankatech.co/errors/kek-destruction-permission-missing
HTTP Status: 409 Conflict

When you see this

The provider refused a call to destroy one of a tenant's retired key-encryption keys, or to cancel its pending destruction, because the managed tier's credential lacks a permission. Nothing was changed at the provider.

  • On a cancel, a platform administrator receives this answer, the key keeps the status it had before the call, and the refusal is recorded in the audit trail as DENIED.
  • On a destruction, the request itself calls no provider and never answers this error. The destruction pass calls the provider when the platform's waiting period ends; a refusal then returns the key to RETIRED with the refusal reason PROVIDER_REFUSED, is recorded in the audit trail as a kek-destruction.execution-failed row with outcome FAILURE, stage PROVIDER and this problem type, and raises the platform alert kek.destruction.failed, which counts the refusal for 7 days, or until a new destruction of the key is requested.

A tenant key-encryption key is destroyed at its provider or HSM, never only in the platform's records. A destruction request moves a RETIRED key to PENDING_DESTRUCTION and calls no provider: the platform holds the destruction for the deployment's waiting period (30 days by default), and until it ends a cancel returns the key to RETIRED with no provider call. When the period ends the platform checks the key again and only then asks its provider or HSM to destroy it; the key becomes DESTROYED only once a read of the provider confirms it gone. Until then the destruction can be cancelled while the key object still exists, which returns the key to RETIRED.

Common Causes

  • The provider authenticated the managed tier's credential and denied the destruction or the cancel. These permissions are needed only to destroy: a tier without them keeps wrapping, unwrapping, provisioning and rotating.
  • extensions.step is PROVIDER_DESTRUCTION and extensions.permissions is a JSON array naming every permission the credential needs on its provider, to destroy and to cancel.
Provider Permissions
AWS KMS kms:DescribeKey, kms:ScheduleKeyDeletion, kms:CancelKeyDeletion, kms:EnableKey
Google Cloud KMS cloudkms.cryptoKeyVersions.list, cloudkms.cryptoKeyVersions.destroy, cloudkms.cryptoKeyVersions.restore, cloudkms.cryptoKeyVersions.update, cloudkms.cryptoKeys.update
Azure Key Vault and Managed HSM The key permissions get, delete and recover. purge is not needed: the vault purges a deleted key itself at the end of its soft-delete retention

Response Example

{
  "type": "https://docs.ankatech.co/errors/kek-destruction-permission-missing",
  "title": "Provider Permission Missing",
  "status": 409,
  "detail": "The managed tier's credential is not permitted to destroy the key-encryption key, or to cancel its destruction, at its provider. Grant the permissions named in extensions.permissions. Nothing was changed.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/keks/3c1f7a9e-2b44-4e0d-8f6a-91d2c7b5e0aa/destroy",
  "timestamp": 1793696400,
  "extensions": {
    "step": "PROVIDER_DESTRUCTION",
    "permissions": ["kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion", "kms:EnableKey", "kms:DescribeKey"],
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Grant the permissions in extensions.permissions to the managed tier's credential, in the provider account the tier is bound to.
  2. Ask again. Nothing changed at the provider, and the key is in the status it had before the refused call. A destruction refused at its execution is requested again, which starts a new waiting period.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.