Switch Terraform backend to use storage account keys instead of Azure AD authentication

[Copilot]

GitHub Actions fails during terraform init with 403 AuthorizationPermissionMismatch. The original approach using Azure AD authentication with role assignments proved unreliable. This PR switches to using storage account keys for simpler and more reliable authentication.

Solution

Changed from Azure AD authentication to storage account key authentication for the Terraform backend:

• GitHub Actions Workflow (.github/workflows/deploy-infrastructure.yml):

  • Removed ARM_USE_AZUREAD_AUTH environment variable from all Terraform steps
  • Updated backend.hcl to use access_key instead of use_azuread_auth
  • Requires new secret: TF_STATE_STORAGE_ACCESS_KEY

• Backend Configuration (backend.hcl.example): Removed use_azuread_auth setting

• Documentation Updates:

  • README.md: Added TF_STATE_STORAGE_ACCESS_KEY to required GitHub secrets, removed Azure AD troubleshooting
  • QUICKSTART.md: Added instructions for obtaining storage account key
  • init-terraform-state.sh: Updated to show storage account key retrieval

• Configuration Examples:

  • terraform.tfvars.example: Made tf_state_* variables optional (commented out)
  • variables.tf: Updated descriptions to reflect optional nature
  • deploy-local.sh: Removed tf_state_* from example

Benefits

• Simpler setup: No role assignments or Azure AD permission propagation delays
• More reliable: Storage account keys work immediately
• Fewer dependencies: No special permissions needed on storage account

Setup for GitHub Actions

Add the storage account access key as a GitHub secret:

az storage account keys list \
  --resource-group rg-mlshop-tfstate \
  --account-name mlshoptfstate \
  --query '[0].value' -o tsv

Add the output as secret TF_STATE_STORAGE_ACCESS_KEY in your GitHub repository.

Original prompt

Fix the issue in deploy infrastructure:
Initializing the backend...
Initializing modules...

• acr in modules/acr
• app_service in modules/app_service
• keyvault in modules/keyvault
• postgresql in modules/postgresql
• static_web_app in modules/static_web_app
  ╷
  │ Error: Failed to get existing workspaces: containers.Client#ListBlobs: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationPermissionMismatch" Message="This request is not authorized to perform this operation using this permission.\nRequestId:db976523-e01e-005b-0b21-65c60c000000\nTime:2025-12-04T13:29:12.3746982Z"

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[aluczak]

@copilot this still doesn't work. Can you update to use storage account keys instead of azure ad authentication?

[Copilot]

@copilot this still doesn't work. Can you update to use storage account keys instead of azure ad authentication?

Switched to storage account key authentication in commit 02eea38.

The workflow now uses TF_STATE_STORAGE_ACCESS_KEY secret instead of Azure AD authentication. To set this up:

# Get the storage account access key
az storage account keys list \
  --resource-group rg-mlshop-tfstate \
  --account-name mlshoptfstate \
  --query '[0].value' -o tsv

# Add the output as a GitHub secret named TF_STATE_STORAGE_ACCESS_KEY

This is simpler and more reliable than the Azure AD approach.