Aria Operations automated snapshot removal jobs fail with "RuntimeFault exception: Permission to perform this operation was denied"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In Aria Operations 8.x, automated jobs configured to remove snapshots fail to complete.

• The job status in the UI may show as "Failed".
• In the log files located at /storage/log/vcops/log/actions-data-<UUID>.log, the following error is observed:

YYYY-MM-DDT HH:MM:SS, message='RuntimeFault exception, message:[Permission to perform this operation was denied.]'}], entryKind='ActionExecutionResult', entryState=FAILED, stampedInfoMessages=[StampedMessage{timeStamp=YYYY-MM-DDT HH:MM:SS, message='Params: RemoveSnapshotParam{snapshotId='<ID>', vmMoid='<VM MOID>', maxResponseWaitSeconds=1800, allowedVMs=[<VM MOID>]} MethodParam{targetResourceId='<Resource UUID>', mOR='<Snapshot MOID>', isValid=true}'}, StampedMessage{timeStamp=YYYY-MM-DDT HH:MM:SS, message='Removing snapshot '<Snapshot MOID>, <VM Name>' on VM 'mor: <VM MOID>, name: <VM Name>''}], stampedErrorMessages=[StampedMessage{timeStamp=YYYY-MM-DDT HH:MM:SS, message='RuntimeFault exception, message:[Permission to perform this operation was denied.]'}]

Environment

Aria Operations 8.18.x

VMware vCenter Server 7.x / 8.x

Cause

This issue occurs if the Service Account used by the VMware vSphere adapter in Aria Operations does not have the necessary permissions in vCenter Server to manage snapshots, or if the credentials stored in Aria Operations are out of sync with the account in vCenter.

Service account password has changed.

Resolution

1. Update Credentials in Aria Operations

   If the password for the service account was recently changed, update the adapter instance:

   1. Log in to the Aria Operations UI with administrative privileges.
   2. Go to Data Sources > Integrations > Accounts.
   3. Select the VMware vSphere adapter instance.
   4. Click the Edit (pencil) icon.
   5. Click the plus (+) icon next to the Credential field or edit the existing one.
   6. Enter the correct password and click OK.
   7. Click Validate Connection to ensure the credentials and permissions are accepted.
   8. Click Save.

2. Assign vCenter Permissions

   Ensure the account has the following privileges assigned at the required level (vCenter, Datacenter, or Cluster) in vSphere:

   • Virtual machine > Provisioning > Create snapshot
   • Virtual machine > Provisioning > Remove snapshot

Or use a Service account which as Admin privileges. 

Additional Information

https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-configuration-guide-8-18/configuring-automation-using-jobs/automation-central.html