This issue can be resolved by adding the appropriate permissions to the user accessing the API:
Via the command-line:
pveum aclmod / -user salt@pve -role PVEVMAdmin
pveum aclmod / -user salt@pve -role PVEDatastoreAdmin
Remember to swap salt@pve
for your own user.
Via the web interface:
- Make sure you're using the Server View and select Datacenter.

- Click on the Permissions tab:

- Click Add and from the drop-down, select User Permission

- In the dialog, under 'Path', enter
/
.
- In the 'User' drop-down, select the user salt-cloud is logging in as.
- Under 'Role', select 'PVEVMAdmin'.

- Repeat steps 3-6 for the 'PVEDatastoreAdmin' permission also.