Sets Azure Storage authentication method from Access Key to Entra User Account

README.md

@@ -2,6 +2,13 @@
 This is a terraform module for initializing a terraform state backend in Azure. 
 
 By default, it creates a resource group named `terraform-state`, a storage account with a unique name, and a container named "terraform-state", 
+
+Azure will not auto-assign sufficient access privilege to your az cli user running terraform automatically. Follow this environment backend module's apply with authenticated:
+```
+az role assignment create --assignee PRINCIPAL_ID --role "Storage Blob Data Contributor" --scope $(terraform output -raw storage_role_access_scope -state=PATH_TO_TFSTATE)
+```
+While the az role assignment is very quick, it may take up to ten minutes for your principal to gain role access to this resource (see [learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access](https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=azure-cli#:~:text=When%20you%20assign%20roles%20or%20remove%20role%20assignments%2C%20it%20can%20take%20up%20to%2010%20minutes%20for%20changes%20to%20take%20effect.)).
+
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
 

main.tf

@@ -17,7 +17,6 @@ provider "azurerm" {
   storage_use_azuread = true
 }
 
-
 resource "random_string" "storage_account_name" {
   length  = 14
   special = false
@@ -26,6 +25,7 @@ resource "random_string" "storage_account_name" {
 
 locals {
   storage_account_name = var.storage_account_name == null ? "tfstate00${random_string.storage_account_name.result}" : var.storage_account_name
+  tfstate_role_access_scope = "${azurerm_storage_account.tfstate.id}/blobServices/default/containers/tfstate"
 }
 
 resource "azurerm_resource_group" "tfstate" {
@@ -109,3 +109,7 @@ output "storage_account_name" {
 output "container_name" {
   value = azurerm_storage_container.tfstate.name
 }
+
+output "tfstate_role_access_scope" {
+  value = local.tfstate_role_access_scope
+}