Deploying Go API to Azure Container Apps - The Right Permissions
· One min read
Deploying a Go API to Azure Container Apps (ACA) via Docker is great—until the permissions block you.
Don’t just default to Owner or Contributor access
The trick to least privilege is splitting access into three specific roles:
AcrPush: Give this to your CI/CD (GitHub/DevOps) to upload the image.
AcrPull: Give this to the Container App’s Managed Identity so it can fetch the image.
Container Apps Contributor: For the deployment command itself. The takeaway: Enable Managed Identity on your app. It’s the easiest way to solve the "Image Pull" error without using insecure admin passwords.