Microsoft Azure · Associate
Microsoft Certified: Cloud and AI Security Engineer Associate
Private Endpoints, VNet rules and CMK require Premium-tier namespaces, which are billed per messaging unit. Standard supports IP firewall rules. This pattern uses Standard with Entra ID-only auth: if the requirement is private networking, you have to move to Premium. In AWS, SQS connects through an interface VPC endpoint.
Contributor does not allow assigning roles in Azure RBAC (it excludes Microsoft.Authorization/*/Write). If your Terraform assigns roles (say, an app's identity on a Key Vault), Contributor is not enough. The quick fix is giving the pipeline Owner or User Access Administrator, which is exactly what you don't want. The right fix is Role Based Access Control Administrator with a condition limiting which roles it can assign (and excluding privileged ones).
With shared_access_key_enabled = false, every data-plane call must authenticate with Entra ID, including the provider's own. Set storage_use_azuread = true on the azurerm provider and grant the pipeline identity a data role (Contributor is control plane only and is not enough).
Azure Storage supports role assignments for both storage accounts and blob containers. To scope by prefix or path you need ABAC conditions on the role assignment (Blob prefix and Blob path attributes). Simple alternative: a container dedicated to ingestion (what this module does).
Letra Chica