"Permission to perform this operation was denied" on performing "vSAN Services - Shutdown Cluster" operation

Products

• VMware vCenter Server
• VMware vSAN

Issue/Introduction

• A user is assigned a non-administrator role on the required datacenter

• The user has been assigned privileges as stated on  KB Article 389560

• Shutting down individual hosts , placing hosts on maintenance mode , modifying cluster settings works with the existing privileges.

• While attempting a Shutdown Cluster operation from the Configure > vSAN > Services page on the cluster, an error appears mentioning "Permission to perform this operation was denied" 

  

• Enabling "trivia" logs on the vCenter Server reveals the below errors on the vCenter Server where  "username" is an example name of the problematic user : 

  YYYY-MM-DDT01:21:35.360Z info vpxd[09534] [Originator@6876 sub=vpxLro opID=agw-0000755-5604-c2] [VpxLRO] -- BEGIN lro-449287 -- AuthorizationManager -- vim.AuthorizationManager.hasPrivilegeOnEntities -- 520610da-2df9-####-####-3b40112a8243(5298362f-276e-####-####-82f3e6709324)
  YYYY-MM-DDT01:21:35.360Z trivia vpxd[09534] [Originator@6876 sub=AuthorizeManager opID=agw-0000755-5604-c2] [CheckEntityPrivByUD] entity=group-d1, priv = Host.Config.Power, res = false, user = VSPHERE.LOCAL\username
  YYYY-MM-DDT01:21:35.360Z verbose vpxd[09534] [Originator@6876 sub=MoAuthMagr opID=agw-0000755-5604-c2] Permission not granted for user VSPHERE.LOCAL\username on entity group-d1 with Privilege ID: Host.Config.Power
  YYYY-MM-DDT01:21:35.360Z trivia vpxd[09534] [Originator@6876 sub=AuthorizeManager opID=agw-0000755-5604-c2] [CheckEntityPrivByUD] entity=group-d1, priv = Host.Inventory.EditCluster, res = false, user = VSPHERE.LOCAL\username
  YYYY-MM-DDT01:21:35.360Z verbose vpxd[09534] [Originator@6876 sub=MoAuthMagr opID=agw-0000755-5604-c2] Permission not granted for user VSPHERE.LOCAL\username on entity group-d1 with Privilege ID: Host.Inventory.EditCluster

Environment

VMware vCenter Server 
VMware vSAN

Cause

This is due to a vSAN specific requirement that requires providing the host privileges on the vCenter level as well. 

Resolution

Assign the role with the host privileges as highlighted on KB Article 389560 to the user on the vCenter Server object by unchecking "Propagate to Children" . 

The resulting configuration would have these privileges on the vCenter Object and the Cluster Object.