title: Assign Azure rbac Role to Virtual Machine using terraform
body: <p>I have a virtual machine in my Azure subscription that should be able to read and write to a storage container in the same subscription.</p>
  <p>Therefore, I created a rbac role that allows for reading and writing from and to storage containers. To assign the role to the VM I enable a system assigned identity in the VM and assign the rbac role with to the system assigned identity with the resource manager id of the container as scope.</p>
  <p>After the VM is started I assume that I should be able to execute some <code>az storage blob ...</code> command in the VM to e.g. list blobs in the given container but the command fails with an authentication issue.</p>
  <pre><code>az storage blob list --account-name examplestorage --container-name example-container
  </code></pre>
  <blockquote>
  <p>There are no credentials provided in your command and environment, we will query for account key for your storage account.<br />
  It is recommended to provide --connection-string, --account-key or --sas-token in your command as credentials.</p>
  <p>You also can add <code>--auth-mode login</code> in your command to use Azure Active Directory (Azure AD) for authorization if your login account is assigned required RBAC roles.<br />
  For more information about RBAC roles in storage, visit <a href="https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli</a>.</p>
  <p>In addition, setting the corresponding environment variables can avoid inputting credentials in your command. Please use --help to get more information about environment variable usage.</p>
  <p>Skip querying account key due to failure: Please run 'az login' to setup account.<br />
  Public access is not permitted on this storage account.<br />
  RequestId:a3f2a5ce-301e-00a6-315b-931f48000000<br />
  Time:2021-08-17T11:30:31.2242111Z<br />
  ErrorCode:PublicAccessNotPermitted<br />
  Error:None</p>
  </blockquote>
  <p>Here are parts of the terraform code I use to create resources and assign the role:</p>
  <pre><code>resource azurerm_storage_account storage_account {
    name                     = &quot;examplestorage&quot;
    resource_group_name      = azurerm_resource_group.example.name
    location                 = azurerm_resource_group.example.location
    account_tier             = &quot;Standard&quot;
    account_replication_type = &quot;LRS&quot;
  }
  
  resource azurerm_storage_container storage_container {
    name                  = &quot;example-container&quot;
    storage_account_name  = azurerm_storage_account.storage_account.name
    container_access_type = &quot;private&quot;
  }
  
  resource azurerm_role_definition storage_access_role {
    name        = &quot;example-storage-access&quot;
    description = &quot;Role granting permissions to access the blob container storage.&quot;
    scope       = data.azurerm_subscription.example.id
  
    permissions {
      actions = [
        &quot;Microsoft.Storage/storageAccounts/blobServices/containers/delete&quot;,
        &quot;Microsoft.Storage/storageAccounts/blobServices/containers/read&quot;,
        &quot;Microsoft.Storage/storageAccounts/blobServices/containers/write&quot;,
      ]
      data_actions = [
        &quot;Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete&quot;,
        &quot;Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read&quot;,
        &quot;Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write&quot;
      ]
    }
  
    assignable_scopes = [
      data.azurerm_subscription.example.id
    ]
  }
  
  resource azurerm_linux_virtual_machine example_instance {
    name                = &quot;example-instance&quot;
    location            = data.azurerm_resource_group.example.location
    resource_group_name = data.azurerm_resource_group.example.name
    size                = &quot;Standard_F2&quot;
    admin_username      = &quot;adminuser&quot;
  
    source_image_reference {
      publisher = &quot;Canonical&quot;
      offer     = &quot;UbuntuServer&quot;
      sku       = &quot;18.04-LTS&quot;
      version   = &quot;latest&quot;
    }
  
    identity {
      type = &quot;SystemAssigned&quot;
    }
  }
  
  resource azurerm_role_assignment example_role_assignment {
    scope              = azurerm_storage_container.storage_container.resource_manager_id
    role_definition_id = azurerm_role_definition.storage_access_role.id
    principal_id       = azurerm_linux_virtual_machine.example_instance.identity[0].principal_id
  }
  
  </code></pre>
  <p>The execution of terraform plan and apply terminates with no error and in my azure portal I see that there is an identity assigned by the system to my VM. The identity has the defined role assigned with the storage container as a scope.</p>
  <p>I did the following tests to check permissions:</p>
  <ul>
  <li>create a service principal with the defined rbac role --&gt; Logging in to azure from my VM using this service principals credentials I am able to list blobs in the container.</li>
  <li>Assign the Contributor role to the system assigned identity with my subscription as a scope --&gt; but the error remains the same.</li>
  </ul>
  <p>My terraform version is: 0.13.04
  The versions of my terraform providers is:
  Initializing provider plugins...</p>
  <ul>
  <li>Using previously-installed hashicorp/cloudinit v2.2.0</li>
  <li>terraform.io/builtin/terraform is built in to Terraform</li>
  <li>Using previously-installed hashicorp/azurerm v2.46.0</li>
  <li>Using previously-installed hashicorp/template v2.2</li>
  </ul>
  <p>Any suggestions what I am missing or doing wrong here? Any help is gratefully appreciated.</p>
  <p>thanks, Christian</p>