Azure Storage blob container assign RBAC using ARM

Question

We currently have ARM templates that create storage accounts and containers in a solution however I can't seem to manage to assign the RBAC access to the container in the ARM template. I have tried using Erik's solution here

"type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
  "apiVersion": "2017-09-01",
  "name": "[concat(parameters('storageAccountName'),'/default/filedrop/Microsoft.Authorization/{NEW GUID}')]",
  "properties": {
    "roleDefinitionId": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
    "principalId": "[parameters('ServicePrincipalId')]"
}

The error I get is "error": { "code": "BadRequestFormat", "message": "The request was incorrectly formatted." } Anyone see where I'm going wrong?

score 2 · Accepted Answer · answered Feb 18 '20 at 08:55

Here is what I used: https://github.com/juunas11/managedidentity-filesharing/blob/8410ed3f3d4061de7d40531c025bf6e474489135/Joonasw.ManagedIdentityFileSharingDemo.ARM/azuredeploy.json#L223-L236

    {
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
      "apiVersion": "2018-01-01-preview",
      "name": "[concat(parameters('storageAccountName'), '/default/', parameters('storageContainerName'), '/Microsoft.Authorization/', guid(resourceGroup().id, 'webAppFilesAccess'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('storageContainerName'))]",
        "[resourceId('Microsoft.Web/sites', parameters('webAppName'))]"
      ],
      "properties": {
        "principalId": "[reference(resourceId('Microsoft.Web/sites', parameters('webAppName')), '2016-08-01', 'Full').identity.principalId]",
        "roleDefinitionId": "[variables('storageBlobContributorRoleId')]"
      }
    }

The main difference I can see is that I have a higher API version + I use parameters for a lot of things.

The guid() function is pretty handy since you can give it some text, and if the text is same, it'll give the same GUID every time.

Azure Storage blob container assign RBAC using ARM

1 Answers1