how to assign rbac to different subscription?

Question

I have blob storage in one subscription and AKS in another subscription. How do I assign an Storage Blob data reader RBAC to AKS using terraform?

Answer 1

Hi Manu,

The trick is to run Terraform with two provider blocks—one pointing at the AKS subscription (where the principal lives) and a second, aliased provider that points at the storage-account subscription (where the scope lives).

1. Declare the default provider for the AKS subscription, then add provider "azurerm" { alias = "storage" subscription_id = var.storage_subscription_id … }.
2. Read the identities you need (data "azurerm_kubernetes_cluster" "aks" to grab kubelet_identity[0].object_id for a managed-identity cluster).
3. Look up the storage account through the storage provider (data "azurerm_storage_account" "sa" { … provider = azurerm.storage }).
4. Create the cross-subscription role assignment with that same provider alias so the request lands in the storage subscription:

resource "azurerm_role_assignment" "aks_blob_reader" { scope = data.azurerm_storage_account.sa.id # /subscriptions/<B>/resourceGroups/…/storageAccounts/… role_definition_name = "Storage Blob Data Reader" principal_id = data.azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id provider = azurerm.storage # <— executes against sub-B }

Terraform just needs whoever is running it to hold User Access Administrator or Owner on the storage subscription; the principal ID can come from any other subscription in the same tenant without extra setup. Behind the scenes this does the same thing you’d get in the CLI—az role assignment create --assignee <aks-object-id> --role "Storage Blob Data Reader" --scope /subscriptions/<sub-B>/…—only expressed as code so it lives in state and can be destroyed later.

5. terraform apply, and AKS now has read access to blobs even though the account sits in a different subscription. (Cross-subscription role assignments are valid as long as both subscriptions share the same Microsoft Entra tenant.)

Best Regards,

Jerald Felix

Answer 2

UI Method

• 1. Go to Storage accounts in Azure Portal, select your storage account.
• 2. Click Access control (IAM) > + Add > Add role assignment.
• 3. Choose Storage Blob Data Reader role.
• 4. Select Managed identity, click + Select members.
• 5. Switch to AKS subscription, pick Kubernetes Service, select AKS cluster’s managed identity, click Select.
• 6. Click Review + assign.
• Ensure AKS has a managed identity and you have permission in both subscriptions.

------ If the response was helpful & resolved your query, Kindly accept the answer ------