I have following Terraform code running:

data "azurerm_client_config" "current" {}

resource "time_static" "time" {}
resource "azurerm_key_vault" "kv" {
  name                            = var.name
  location                        = var.location
  resource_group_name             = var.resource_group_name
  sku_name                        = var.sku_name
  enabled_for_disk_encryption     = true
  enabled_for_template_deployment = true
  tenant_id                       = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days      = var.soft_delete_retention_days
  purge_protection_enabled        = true
  enable_rbac_authorization       = var.enable_rbac_authorization
  public_network_access_enabled   = var.public_network_access_enabled

  tags = merge({ StartDate = formatdate("DD-MM-YYYY", time_static.time.rfc3339) }, var.env_tags)

  lifecycle {
    ignore_changes = [tags]
  }
}


resource "azurerm_role_assignment" "kv_admin" {
  count                = azurerm_key_vault.kv.enable_rbac_authorization ? 1 : 0
  scope                = azurerm_key_vault.kv.id
  role_definition_name = "Key Vault Administrator"
  principal_id         = data.azurerm_client_config.current.object_id
}

While deploying via GitHub Action using Service Principal I’m facing following error message:

│ Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '93exxx-xxxx-xxxx-xxxx-xxxx' with object id '93exxx-xxxx-xxxx-xxxx-xxxx' has an authorization with ABAC condition that is not fulfilled to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/mysubscriptionId/resourceGroups/myResourceGroup/providers/Microsoft.KeyVault/vaults/myKeyVault/providers/Microsoft.Authorization/roleAssignments/dbb6320d-32b0-1388-824b-45b898f97b92' or the scope is invalid. If access was recently granted, please refresh your credentials."

Client running Terraform has Owner assignment on a subscription added:

We don’t have any Deny assignment running across specific resource/resource group/subscription. Any ideas what might be causing this?