sincecutoff.com
/v1/json /v1/md llms.txt
← all changes

terragrunt azure-backend assigns Azure blob data role during bootstrap

Introduced 2026-09-14 · score 0.94

HOW TO USE IT

When bootstrapping an Azure `azurerm` backend with Azure AD authentication, enable the `azure-backend` experiment and set `assign_blob_data_role = true` to grant Storage Blob Data Contributor to Terragrunt’s authenticated identity. Set `principal_id` to grant the role to a different identity.

terragrunt --experiment azure-backend backend bootstrap
remote_state { backend = "azurerm" config = { storage_account_name = "<storage-account>" container_name = "<container>" key = "<state-key>" resource_group_name = "<resource-group>" use_azuread_auth = true assign_blob_data_role = true # Optional: principal_id = "<entra-object-id>" } }

WHY THIS HELPS

Bootstrap an Azure remote state backend with an Azure AD identity that needs access to the state blobs.

BEFORE THIS CHANGE

An identity could bootstrap the backend, then require someone to grant the blob data-plane role manually before it could read state.

REQUIREMENTS AND LIMITATIONS

  • Version: v1.1.5
  • Availability: Requires the `azure-backend` experiment.
  • --experiment azure-backend (required): Enables Terragrunt’s experimental Azure backend bootstrap support.
  • backend = "azurerm" (required): Selects the Azure Storage backend.
  • storage_account_name (required): Names the Azure storage account for state.
  • container_name (required): Names the blob container for state.
  • key (required): Specifies the state blob key.
  • resource_group_name (required): Names the resource group for the storage account.
  • use_azuread_auth (required): Enables Azure AD authentication for the backend.
  • assign_blob_data_role (required): When `true`, bootstrap assigns Storage Blob Data Contributor on the storage account. Opt-in; assignment creation requires `Microsoft.Authorization/roleAssignments/write`.
  • principal_id: Microsoft Entra object ID receiving the role when `assign_blob_data_role` is true; defaults to the caller resolved from the access token.
  • Prerequisite: Use the `azure-backend` experiment for Azure backend bootstrap.
  • Prerequisite: Role assignment creation requires `Microsoft.Authorization/roleAssignments/write`; the documented roles with this permission are Owner and User Access Administrator, not Contributor.
  • Prerequisite: With Azure AD authentication, reading and writing state requires Storage Blob Data Contributor on the storage account.
  • The setting is opt-in.
  • Creating a role assignment requires `Microsoft.Authorization/roleAssignments/write`, which Contributor does not include.
  • Reruns need only read permission on role assignments.
  • The authenticated identity is resolved from the access token Terragrunt already holds; it works for identities that cannot read Microsoft Entra.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card