Remote Console fails with HTTP 408 Timeout and SOAP Fault "Permission to perform this operation was denied" for recently onboarded VMs in VMware Aria Automation

Products

• VCF Automation

Issue/Introduction

• You are unable to open the Remote Console (WebMKS) for specific newly onboarded virtual machines in VMware Aria Automation.

• The issue is isolated to a subset of systems within a cluster, while other VMs open successfully.

• The VMware Aria Automation UI throws the following error:

  Http failure response for https://<AriaAutomationFQDN>/provisioning/uerp/provisioning/mgmt/compute-remote-console/<UUID>: 408 OK

Environment

• VMware Aria Automation 8.12 or later utilizing WebMKS proxy

• vSphere Cloud Account using a least-privilege service account

Cause

• The VMware Aria Automation internal provisioning-service attempts to acquire a WebMKS websocket ticket directly from the vCenter API.

• The vCenter server actively rejects the AcquireTicket API payload because the vSphere Service Account configured in the Aria Automation Cloud Account lacks adequate Role-Based Access Control (RBAC) privileges on the target Virtual Machine object.

• Because vSphere applies permissions hierarchically, this issue presents as "isolated" when specific VMs are placed into a vSphere Folder, Resource Pool, or Datastore where permission inheritance from the parent Datacenter/Cluster is explicitly disabled or overridden by a conflicting rule.

Resolution

1. Identify the target VM in the vSphere Client using the Managed Object Reference (MoRef) ID found in the logs (e.g., vm-12345).

2. Inspect the Permissions tab of the VM and its parent Folder.

3. Modify the vSphere permissions to ensure the VMware Aria Automation Cloud Account service user is granted a role containing the following minimum privilege on the VM object: Virtual machine -> Interaction -> Console interaction.

4. Re-attempt the Remote Console connection from the VMware Aria Automation deployment topology.

No service restarts on the VMware Aria Automation appliance are required.

Additional Information

• To retrieve the logs for verification, run kubectl logs -n prelude deployment/provisioning-service-app.

• Relevant log excerpt from provisioning-service-app.log:

  Timeout in remote operation after 80 seconds
  GET http://10.244.#.###:8282/provisioning/mgmt/compute-remote-console
  ...
  2026-02-13T20:30:56.132Z WARN provisioning [host='provisioning-service-app-######-#####' thread='vsphere-io-24' user='' org='' trace='' parent='' span=''] c.v.xenon.common.ServiceErrorResponse.create:85 - message: Cannot acquire ticket of vmMoRefVirtualMachine:vm-12345, statusCode: 400, serverErrorId: ErrorUUID: Caused by java.lang.Exception: Cannot acquire ticket of vmMoRefVirtualMachine:vm-12345
          Caused by: com.sun.xml.ws.fault.ServerSOAPFaultException: Client received