3.8.4¶
Release Date: August 10, 2026
🐛 Bug Fixes¶
Terraform Modules¶
Grant Storage Blob Data Contributor To The App Registration Service Principal 🔗¶
Module: saif-resources/modules/storage
Fixes a runtime authorization failure that made every data-plane call to Azure Blob Storage return HTTP 403:
Status: 403 (This request is not authorized to perform this operation using this permission.)
ErrorCode: AuthorizationPermissionMismatch
Because the failure was at runtime rather than at plan or apply time, terraform apply reported success and the application only broke once it started serving traffic. The Azure_BlobServiceClient health check reported Unhealthy, which in turn failed the App Service health probe and could pull the instance out of rotation.
The module granted Storage Blob Data Owner to the application's User-Assigned Managed Identity. That was correct when it was written, but it no longer describes which identity the application actually presents. Since 3.2.7 the platform pins DefaultAzureCredential to EnvironmentCredential through the AZURE_TOKEN_CREDENTIALS and AZURE_CLIENT_ID app settings emitted by modules/identity/outputs.tf, a change made for Aspire 13.2 compatibility. From that point on the runtime data-plane identity is the app registration service principal, not the UAMI. The service principal held no blob role at all, so every request was denied while the role assignment on the UAMI sat unused.
The module now grants Storage Blob Data Contributor to the app registration service principal in place of the Storage Blob Data Owner assignment on the UAMI. That matches the platform identity convention already in force elsewhere: the UAMI covers platform concerns such as ACR pull and Key Vault reference resolution, while the app registration service principal covers runtime data-plane access. It also matches the role Aspire assigns by default for AddAzureStorage.
Contributor rather than Owner is deliberate. The only capability Owner adds over Contributor is POSIX ACL management on ADLS Gen2 hierarchical namespaces, which Forge applications do not use, so Contributor is the least-privilege role that still covers every read and write path.
Action required: consuming applications pick this up on their next terraform apply after upgrading to 3.8.4. The apply removes the UAMI role assignment and creates the service principal one in its place. Restart the application afterwards so the blob health check re-evaluates. In validation this took less than a minute, but Microsoft documents that Azure RBAC role assignment changes can take up to 10 minutes to take effect, so wait that long before treating a lingering 403 as a failure.
The fix was validated end to end against a live test application: a blob upload (POST) and a blob listing (GET) both returned 200, and the App Service HealthCheckStatus metric recovered to 100.
🔄 Breaking Changes¶
None in this release ✅
📋 Additional Notes¶
- Total commits: 1
- Contributors: Emmitt Johnson
Support¶
- 📧 Teams Support Channel: Support