Add references for additional role assignments

Author: marvinbuss

code/infra/roleassignments.tf

@@ -4,19 +4,34 @@ resource "azurerm_role_assignment" "current_role_assignment_key_vault" {
   principal_id         = data.azurerm_client_config.current.object_id
 }
 
-resource "azurerm_role_assignment" "function_role_assignment_storage" {
+resource "azurerm_role_assignment" "function_role_assignment_storage_blob_data_owner" {
   scope                = azurerm_storage_account.storage.id
   role_definition_name = "Storage Blob Data Owner"
   principal_id         = azapi_resource.function.identity[0].principal_id
 }
 
+# resource "azurerm_role_assignment" "function_role_assignment_storage_account_contributor" { # Enable when using blob triggers
+#   scope                = azurerm_storage_account.storage.id
+#   role_definition_name = "Storage Account Contributor"
+#   principal_id         = azapi_resource.function.identity[0].principal_id
+# }
+
+# resource "azurerm_role_assignment" "function_role_assignment_storage_queue_data_contributor" { # Enable when using blob triggers
+#   scope                = azurerm_storage_account.storage.id
+#   role_definition_name = "Storage Queue Data Contributor"
+#   principal_id         = azapi_resource.function.identity[0].principal_id
+# }
+
+# Additional permissions may be required based on the trigger that is being used.
+# For more details, refer to: https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-python#grant-permission-to-the-identity
+
 resource "azurerm_role_assignment" "function_role_assignment_key_vault" {
   scope                = azurerm_key_vault.key_vault.id
   role_definition_name = "Key Vault Secrets Officer"
   principal_id         = azapi_resource.function.identity[0].principal_id
 }
 
-# resource "azurerm_role_assignment" "function_role_assignment_application_insights" {
+# resource "azurerm_role_assignment" "function_role_assignment_application_insights" { # Enable to rely on Entra ID-based authentication to Application Insights
 #   scope                = azurerm_application_insights.application_insights.id
 #   role_definition_name = "Monitoring Metrics Publisher"
 #   principal_id         = azapi_resource.function.identity[0].principal_id