https://github.com/martinjt/aks-otel-demo/blob/main/infra/AKSCluster.cs#L99 That's an example of taking the system managed identity out of the AKS cluster and granting it DNS Contributor roles.

I ended up doing something a little different. I'm creating a User Assigned Identity rather than using the System Assigned Identity of a resource...

var identity = new UserAssignedIdentity(NameGenerator.ManagedIdentity("marketplace"), new UserAssignedIdentityArgs
    {
        ResourceGroupName = resourceGroup.Name
    });

Then assigning it to my Azure Web App via the Identity property, and then assigining it to each service where access is required. For example, here is a Storage Account...

var roleAssignment = new RoleAssignment("storageAccountRoleAssignment", new RoleAssignmentArgs
        {
            PrincipalId = identity.PrincipalId.Apply(x => x),
            RoleDefinitionId = RoleDefinitions.StorageAccountContributor,
            Scope = Resource.Id,
            PrincipalType = PrincipalType.ServicePrincipal
        });

Though now I am wondering if using System Assigned may be better than User Assigned 😄