Skip to content

Commit 6e50f97

Browse files
Prachig-MicrosoftCopilot
Prachig-Microsoft
and
Copilot
committed
infra: add Storage Blob Data Contributor role for backend app identity
Backend container app needs Storage Blob Data Contributor on the storage account to upload files. Added to role-assignments.bicep for both avm and bicep flavors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 476d10f commit 6e50f97

5 files changed

Lines changed: 79 additions & 9 deletions

File tree

‎infra/avm/main.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.43.8.12551",
9-
"templateHash": "12751579259960962504"
9+
"templateHash": "15764079419575495208"
1010
}
1111
},
1212
"parameters": {
@@ -37799,7 +37799,7 @@
3779937799
"_generator": {
3780037800
"name": "bicep",
3780137801
"version": "0.43.8.12551",
37802-
"templateHash": "10896981330923040072"
37802+
"templateHash": "16220137308567374453"
3780337803
}
3780437804
},
3780537805
"parameters": {
@@ -37985,6 +37985,18 @@
3798537985
"principalType": "ServicePrincipal"
3798637986
}
3798737987
},
37988+
{
37989+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
37990+
"type": "Microsoft.Authorization/roleAssignments",
37991+
"apiVersion": "2022-04-01",
37992+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
37993+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
37994+
"properties": {
37995+
"principalId": "[parameters('backendAppServicePrincipalId')]",
37996+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
37997+
"principalType": "ServicePrincipal"
37998+
}
37999+
},
3798838000
{
3798938001
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
3799038002
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",

‎infra/avm/modules/identity/role-assignments.bicep‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,17 @@ resource searchStorageReader 'Microsoft.Authorization/roleAssignments@2022-04-01
216216
}
217217
}
218218

219+
// Backend App → Storage Blob Data Contributor
220+
resource backendAppStorageContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
221+
name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageBlobDataContributor)
222+
scope: storageAccount
223+
properties: {
224+
principalId: backendAppServicePrincipalId
225+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataContributor)
226+
principalType: 'ServicePrincipal'
227+
}
228+
}
229+
219230
// ============================================================================
220231
// 4. COSMOS DB ROLE ASSIGNMENTS
221232
// Backend App Service → Cosmos DB (data-plane, uses sqlRoleAssignments)

‎infra/bicep/main.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.43.8.12551",
8-
"templateHash": "6189751586948713756"
8+
"templateHash": "2315337546245675369"
99
}
1010
},
1111
"parameters": {
@@ -2582,7 +2582,7 @@
25822582
"_generator": {
25832583
"name": "bicep",
25842584
"version": "0.43.8.12551",
2585-
"templateHash": "11340155083243769350"
2585+
"templateHash": "17859174180959627964"
25862586
}
25872587
},
25882588
"parameters": {
@@ -2787,6 +2787,18 @@
27872787
"principalType": "ServicePrincipal"
27882788
}
27892789
},
2790+
{
2791+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
2792+
"type": "Microsoft.Authorization/roleAssignments",
2793+
"apiVersion": "2022-04-01",
2794+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
2795+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
2796+
"properties": {
2797+
"principalId": "[parameters('backendAppServicePrincipalId')]",
2798+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
2799+
"principalType": "ServicePrincipal"
2800+
}
2801+
},
27902802
{
27912803
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
27922804
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",

‎infra/bicep/modules/identity/role-assignments.bicep‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,17 @@ resource searchStorageReader 'Microsoft.Authorization/roleAssignments@2022-04-01
224224
}
225225
}
226226

227+
// Backend App → Storage Blob Data Contributor
228+
resource backendAppStorageContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
229+
name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageBlobDataContributor)
230+
scope: storageAccount
231+
properties: {
232+
principalId: backendAppServicePrincipalId
233+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataContributor)
234+
principalType: 'ServicePrincipal'
235+
}
236+
}
237+
227238
// ============================================================================
228239
// 4. COSMOS DB ROLE ASSIGNMENTS
229240
// Backend App Service → Cosmos DB (data-plane, uses sqlRoleAssignments)

‎infra/main.json‎

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.43.8.12551",
9-
"templateHash": "2620189491489939431"
9+
"templateHash": "16763602987372761236"
1010
}
1111
},
1212
"parameters": {
@@ -316,7 +316,7 @@
316316
"_generator": {
317317
"name": "bicep",
318318
"version": "0.43.8.12551",
319-
"templateHash": "12751579259960962504"
319+
"templateHash": "15764079419575495208"
320320
}
321321
},
322322
"parameters": {
@@ -38109,7 +38109,7 @@
3810938109
"_generator": {
3811038110
"name": "bicep",
3811138111
"version": "0.43.8.12551",
38112-
"templateHash": "10896981330923040072"
38112+
"templateHash": "16220137308567374453"
3811338113
}
3811438114
},
3811538115
"parameters": {
@@ -38295,6 +38295,18 @@
3829538295
"principalType": "ServicePrincipal"
3829638296
}
3829738297
},
38298+
{
38299+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
38300+
"type": "Microsoft.Authorization/roleAssignments",
38301+
"apiVersion": "2022-04-01",
38302+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
38303+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
38304+
"properties": {
38305+
"principalId": "[parameters('backendAppServicePrincipalId')]",
38306+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
38307+
"principalType": "ServicePrincipal"
38308+
}
38309+
},
3829838310
{
3829938311
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
3830038312
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
@@ -38672,7 +38684,7 @@
3867238684
"_generator": {
3867338685
"name": "bicep",
3867438686
"version": "0.43.8.12551",
38675-
"templateHash": "6189751586948713756"
38687+
"templateHash": "2315337546245675369"
3867638688
}
3867738689
},
3867838690
"parameters": {
@@ -41249,7 +41261,7 @@
4124941261
"_generator": {
4125041262
"name": "bicep",
4125141263
"version": "0.43.8.12551",
41252-
"templateHash": "11340155083243769350"
41264+
"templateHash": "17859174180959627964"
4125341265
}
4125441266
},
4125541267
"parameters": {
@@ -41454,6 +41466,18 @@
4145441466
"principalType": "ServicePrincipal"
4145541467
}
4145641468
},
41469+
{
41470+
"condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
41471+
"type": "Microsoft.Authorization/roleAssignments",
41472+
"apiVersion": "2022-04-01",
41473+
"scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
41474+
"name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
41475+
"properties": {
41476+
"principalId": "[parameters('backendAppServicePrincipalId')]",
41477+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
41478+
"principalType": "ServicePrincipal"
41479+
}
41480+
},
4145741481
{
4145841482
"condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
4145941483
"type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",

0 commit comments

Comments
 (0)