Azure – How to assign custom role to the application in Bicep

Getting no permission to add Azure roles to the account message.

I am trying to add Azure role assignments to the storage account. I am creating a function app in bicep, and the next step after that is, I want to add the ‘Storage Blob Data Owner’ role for that application.

This is being executed in Github via github action with a bicep script.

Authorization failed for template resource ‘guid’ of type ‘Microsoft.Authorization/roleAssignments’. The client ‘client id’ with object id ‘client id’ does not have permission to perform action ‘Microsoft.Authorization/roleAssignments/write’ at scope ‘/subscriptions//resourceGroups/rg-

So the solution is to add create a custom role which has the write persmission, but how do i add that custom role to the function app in bicep

resource roleAssignmentStorage ‘Microsoft.Authorization/roleAssignments@2020-04-01-preview’ = {
name: guid(subscription().id, principalId, roleDefinitionResourceId)
properties: {
roleDefinitionId: roleDefinitionResourceId
principalId: principalId
principalType: ‘ServicePrincipal’
}
}

I dont know how to assign the custom RBAC role i created