No Permission to Perform Disk Snapshots ARO4.3

Hello,

Use Case: need to backup a stateful which has persistent volumes attached using Azure Snapshot API

Error: time="2020-05-13T10:10:07Z" level=error msg="Error backing up item" backup=velero/mysql error="error taking snapshot of volume: rpc error: code = Unknown desc = compute.SnapshotsClient#CreateOrUpdate: Failure sending request: StatusCode=0 -- Original Error: autorest/azure: Service returned an error. Status=403 Code=\"LinkedAuthorizationFailed\" Message=\"The client 'XXX' with object id 'XXX' has permission to perform action 'Microsoft.Compute/snapshots/write' on scope '/subscriptions/XXX/resourceGroups/velero-backup/providers/Microsoft.Compute/snapshots/aro43-eastus-cluster-cmrkj-dynamic-pvc-eca9-XXX'; however, it does not have permission to perform action 'Microsoft.Compute/disks/beginGetAccess/action' on the '0' linked scope(s) '' or the linked scope(s) are invalid and is blocked by deny assignments on the '1' linked scope(s) '/subscriptions/XXXX/resourceGroups/aro43-nodes-eastus-rg/providers/Microsoft.Compute/disks/aro43-eastus-cluster-cmrkj-dynamic-pvc-eca97347-XXXX'.\"" group=v1 logSource="pkg/backup/resource_backupper.go:287" name=mysql-0 namespace=default resource=pods

Repro:
the simplest repo is to use the portal to snapshot one of the OS Disks, below is for a statefulset;

1- create a stateful set
$ kubectl get statefulsets
NAME READY AGE
mysql 1/1 11h

$ k get pv -o wide
NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE VOLUMEMODE
pvc-ecaXXX 10Gi RWO Delete Bound default/data-mysql-0 managed-premium 11h Filesystem

2- create a disksnapshot
$ az snapshot create -g MyResourceGroup -n MySnapshot2 --source "/subscriptions/00000/resource
Groups/AnotherResourceGroup/providers/Microsoft.Compute/disks/MyDisk"

Environment:
$ az aro show -n aro43-eastus-cluster -g aro43-master-eastus-rg
{
"apiserverProfile": {
"ip": "X",
"url": "X",
"visibility": "Public"
},
"clusterProfile": {
"domain": "61mb93pj",
"pullSecret": null,
"resourceGroupId": "/subscriptions/XXXX/resourceGroups/aro43-nodes-eastus-rg",
"version": "4.3.13"
},
"consoleProfile": {
"url": "XXX"
},
"id": "/subscriptions/XXXX/resourceGroups/aro43-master-eastus-rg/providers/Microsoft.RedHatOpenShift/openShiftClusters/aro43-eastus-cluster",
"ingressProfiles": [
{
"ip": "XXXX",
"name": "default",
"visibility": "Public"
}
],
"location": "eastus",
"masterProfile": {
"subnetId": "/subscriptions/XXXX/resourceGroups/aro43-master-eastus-rg/providers/Microsoft.Network/virtualNetworks/aro43-eastus-vnet/subnets/aro43_masters_subnett",
"vmSize": "Standard_D8s_v3"
},
"name": "aro43-eastus-cluster",
"networkProfile": {
"podCidr": "10.0.0.0/16",
"serviceCidr": "172.16.0.0/16"
},
"provisioningState": "Succeeded",
"resourceGroup": "aro43-master-eastus-rg",
"servicePrincipalProfile": {
"clientId": "XXXX",
"clientSecret": null
},
"tags": {
"k1": "v1",
"k2": "v2"
},
"type": "Microsoft.RedHatOpenShift/openShiftClusters",
"workerProfiles": [
{
"count": 1,
"diskSizeGb": 128,
"name": "aro43-eastus-cluster-cmrkj-worker-eastus1",
"subnetId": "/subscriptions/XXXX/resourceGroups/aro43-master-eastus-rg/providers/Microsoft.Network/virtualNetworks/aro43-eastus-vnet/subnets/aro_workers_subnet",
"vmSize": "Standard_D4s_v3"
},
{
"count": 1,
"diskSizeGb": 128,
"name": "aro43-eastus-cluster-cmrkj-worker-eastus1-a",
"subnetId": "/subscriptions/XXXX/resourceGroups/aro43-master-eastus-rg/providers/Microsoft.Network/virtualNetworks/aro43-eastus-vnet/subnets/aro_workers_subnet",
"vmSize": "Standard_D4s_v3"
},
{
"count": 1,
"diskSizeGb": 128,
"name": "aro43-eastus-cluster-cmrkj-worker-eastus2",
"subnetId": "/subscriptions/XXXX/resourceGroups/aro43-master-eastus-rg/providers/Microsoft.Network/virtualNetworks/aro43-eastus-vnet/subnets/aro_workers_subnet",
"vmSize": "Standard_D4s_v3"
},
{
"count": 1,
"diskSizeGb": 128,
"name": "aro43-eastus-cluster-cmrkj-worker-eastus3",
"subnetId": "/subscriptions/XXXX/resourceGroups/aro43-master-eastus-rg/providers/Microsoft.Network/virtualNetworks/aro43-eastus-vnet/subnets/aro_workers_subnet",
"vmSize": "Standard_D4s_v3"
},
{
"count": null,
"diskSizeGb": 128,
"name": "ms-eastus1",
"subnetId": "/subscriptions/XXXX/resourceGroups/aro43-master-eastus-rg/providers/Microsoft.Network/virtualNetworks/aro43-eastus-vnet/subnets/aro_workers_subnet",
"vmSize": "Standard_D4s_v3"
}
]
}