Azure Storage blob container assign RBAC using ARM

Question

We currently have ARM templates that create storage accounts and containers in a solution however I can't seem to manage to assign the RBAC access to the container in the ARM template. I have tried using Erik's solution here

"type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
  "apiVersion": "2017-09-01",
  "name": "[concat(parameters('storageAccountName'),'/default/filedrop/Microsoft.Authorization/{NEW GUID}')]",
  "properties": {
    "roleDefinitionId": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
    "principalId": "[parameters('ServicePrincipalId')]"
}

The error I get is "error": { "code": "BadRequestFormat", "message": "The request was incorrectly formatted." } Anyone see where I'm going wrong?

Answer 1

Here is what I used: https://github.com/juunas11/managedidentity-filesharing/blob/8410ed3f3d4061de7d40531c025bf6e474489135/Joonasw.ManagedIdentityFileSharingDemo.ARM/azuredeploy.json#L223-L236

    {
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
      "apiVersion": "2018-01-01-preview",
      "name": "[concat(parameters('storageAccountName'), '/default/', parameters('storageContainerName'), '/Microsoft.Authorization/', guid(resourceGroup().id, 'webAppFilesAccess'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), 'default', parameters('storageContainerName'))]",
        "[resourceId('Microsoft.Web/sites', parameters('webAppName'))]"
      ],
      "properties": {
        "principalId": "[reference(resourceId('Microsoft.Web/sites', parameters('webAppName')), '2016-08-01', 'Full').identity.principalId]",
        "roleDefinitionId": "[variables('storageBlobContributorRoleId')]"
      }
    }

The main difference I can see is that I have a higher API version + I use parameters for a lot of things.

The guid() function is pretty handy since you can give it some text, and if the text is same, it'll give the same GUID every time.