https://pulumi.com logo
Title
r

rhythmic-vegetable-87369

01/15/2020, 6:18 AM
b

better-rainbow-14549

01/15/2020, 9:07 AM
I guess that when you run it locally it's running as your actual personal user, not as the service principal from your pipeline - and that you personally have the 'Contributor' or 'Owner' permissions on that resource group. I manually set all the ARM_ env. vars. locally to reference the details of the pipeline's SP so I can test locally.
p

powerful-football-81694

01/15/2020, 11:09 AM
@rhythmic-vegetable-87369 I think @better-rainbow-14549 might be right. The client ID of the service principal is there in the error message:
21b1f2bf-4c53-4095-9ce2-4af53127ba02
You can start by checking if this matches the service principal you think should be used by your pipeline, and if yes, check that it has the necessary role assignments on the storage account (or higher) to create additional role assignments.
r

rhythmic-vegetable-87369

01/15/2020, 11:17 AM
Thanks, I'm looking into that.
Much appreciated
c

colossal-room-15708

01/16/2020, 1:31 AM
yes, your pipeline runs in a different context than your local which most likely uses your authenticated user session