Cannot apply different backup policies to storage containers in the same storage account

[celloza]

At the moment, configuring the module like this isn't possible:

module "az_backup" {
  depends_on                 = [azurerm_resource_group.azbackup_rg]
   ...
  use_extended_retention     = false
  log_analytics_workspace_id = azurerm_log_analytics_workspace.backup.id

  tags = merge(local.default_tags, {})

  blob_storage_backups = {
    imagebackups = {
      backup_name                  = "imagebackups"
      retention_period             = "P1D"
      backup_intervals             = ["R/2025-01-01T00:00:00+00:00/P1D"]
      storage_account_id           = azurerm_storage_account.backup_target.id
      storage_account_containers   = [
        azurerm_storage_container.nhsapp_images_sc.name
      ]
    },
    otherbackups = {
      backup_name                  = "otherbackups"
      retention_period             = "P7D"
      backup_intervals             = ["R/2025-01-01T00:00:00+00:00/P1D"]
      storage_account_id           = azurerm_storage_account.backup_target.id
      storage_account_containers   = [
        azurerm_storage_container.nhsapp_ado_sc.name,
        azurerm_storage_container.nhsapp_akamai_sc.name,
        azurerm_storage_container.nhsapp_secrets_sc.name
      ]
    }
  }

In the above example, I have a single Storage Account containing multiple Storage Containers. I want to backup my images with one retention period and frequency, and my ado, akamai, and secrets using a different period and frequency.

However, for each of the blob_storage_backups configurations, the following resources are created:

• azurerm_data_protection_backup_policy_blob_storage, specifying the frequency and retention period
• azurerm_data_protection_backup_instance_blob_storage, specifying the storage account and storage container(s)
• azurerm_role_assignment, allowing access from the vault to the storage account as a Storage Account Backup Contributor

When running the above Terraform, it would fail since the Role Assignment would already exist at the point where the second one is created.

There is a workaround though... create an individual storage account for each frequency and period.

Should the azurerm_data_protection_backup_policy_blob_storage and azurerm_role_assignment resources maybe split out? Then multiple azurerm_data_protection_backup_instance_blob_storage resources created?