{
  "slug": "terragrunt-azure-backend-assigns-azure-blob-data-role-during-bootstrap-4b5e0b82acd6",
  "title": "terragrunt azure-backend assigns Azure blob data role during bootstrap",
  "tools": [
    "terragrunt"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-14T21:06:29.000Z",
  "announced_at": "2026-09-14T21:06:29.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When bootstrapping an Azure `azurerm` backend with Azure AD authentication, enable the `azure-backend` experiment and set `assign_blob_data_role = true` to grant Storage Blob Data Contributor to Terragrunt’s authenticated identity. Set `principal_id` to grant the role to a different identity.",
    "examples": [
      "terragrunt --experiment azure-backend backend bootstrap",
      "remote_state {\n  backend = \"azurerm\"\n  config = {\n    storage_account_name  = \"<storage-account>\"\n    container_name        = \"<container>\"\n    key                   = \"<state-key>\"\n    resource_group_name   = \"<resource-group>\"\n    use_azuread_auth      = true\n    assign_blob_data_role = true\n    # Optional: principal_id = \"<entra-object-id>\"\n  }\n}"
    ],
    "gotchas": [
      "Version: v1.1.5",
      "Availability: Requires the `azure-backend` experiment.",
      "--experiment azure-backend (required): Enables Terragrunt’s experimental Azure backend bootstrap support.",
      "backend = \"azurerm\" (required): Selects the Azure Storage backend.",
      "storage_account_name (required): Names the Azure storage account for state.",
      "container_name (required): Names the blob container for state.",
      "key (required): Specifies the state blob key.",
      "resource_group_name (required): Names the resource group for the storage account.",
      "use_azuread_auth (required): Enables Azure AD authentication for the backend.",
      "assign_blob_data_role (required): When `true`, bootstrap assigns Storage Blob Data Contributor on the storage account. Opt-in; assignment creation requires `Microsoft.Authorization/roleAssignments/write`.",
      "principal_id: Microsoft Entra object ID receiving the role when `assign_blob_data_role` is true; defaults to the caller resolved from the access token.",
      "Prerequisite: Use the `azure-backend` experiment for Azure backend bootstrap.",
      "Prerequisite: Role assignment creation requires `Microsoft.Authorization/roleAssignments/write`; the documented roles with this permission are Owner and User Access Administrator, not Contributor.",
      "Prerequisite: With Azure AD authentication, reading and writing state requires Storage Blob Data Contributor on the storage account.",
      "The setting is opt-in.",
      "Creating a role assignment requires `Microsoft.Authorization/roleAssignments/write`, which Contributor does not include.",
      "Reruns need only read permission on role assignments.",
      "The authenticated identity is resolved from the access token Terragrunt already holds; it works for identities that cannot read Microsoft Entra."
    ]
  },
  "why_it_matters": "Bootstrap an Azure remote state backend with an Azure AD identity that needs access to the state blobs.",
  "before": "An identity could bootstrap the backend, then require someone to grant the blob data-plane role manually before it could read state.",
  "sources": [
    "https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.5",
    "https://docs.terragrunt.com/features/units/state-backend/"
  ],
  "rank": 0.9403,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-5d39902433a97c96-4:gate",
    "evidence_hash": "a0b224494781009d5bade0a0f232cffc6784e38957cb3d84b2c4e6eacf6ffd74"
  },
  "review": {
    "draft_hash": "98dc8f6f19828657a70f62379bcf7497f4532c265bda16f1b4958c80ee029f2e",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.94 >= 0.9; 2 needed) and Jev gave 0.63 (>= 0.6 needed)."
  }
}