Azure CLI RBAC

Examples of using az to create RBAC roles or similar:

# Create a service principal
az ad sp create-for-rbac --name "my-infra-sp"

# Assign Contributor role at resource group level
az role assignment create \
  --assignee "APP_ID" \
  --role Contributor \
  --scope "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP"

# Assign Key Vault role
az role assignment create \
  --assignee "APP_ID" \
  --role 'Key Vault Crypto Officer' \
  --scope "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP/providers/Microsoft.KeyVault/vaults/VAULT_NAME"

# Assign Storage Blob role
az role assignment create \
  --assignee "APP_ID" \
  --role 'Storage Blob Data Contributor' \
  --scope "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP/providers/Microsoft.Storage/storageAccounts/STORAGE_ACCOUNT"

# Reset credentials
az ad sp credential reset --id SERVICE_PRINCIPAL_ID

Be sure that you do not include credentials in your code or check them into source control.