I don’t get it. I create an Azure Storage account. I gave a Service Principal both Storage Blob Data Contributor and Storage Queue Data Contributor permissions to the Storage Account.

My backend config in Terraform is:

  backend "azurerm" {
    storage_account_name = "storage_account"
    container_name       = "tfstate"
    key                  = "terraform.tfstate"
    client_id            = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    subscription_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    tenant_id            = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    use_azuread_auth     = true
  }
}

However, when I run terraform init I get:

Error: Failed to get existing workspaces: containers.Client#ListBlobs: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationPermissionMismatch" Message="This request is not authorized to perform this operation using this permission.nRequestId:18cdcac5-001e-002d-18b1-9a6185000000nTime:2024-04-30T03:47:06.1161648Z"

Aside from adding the IAM for the SPN to the Storage Account, everything else about the Storage Account is default.

All of the guidance I see on the web pretty much advises the same thing (IAM permissions), but for the life of me, I cannot get it to work.