RBAC role assignment on existing resources

[subesokun]

I want to manage role assignments via Bicep on an existing resource (which may not have been created by bicep). However, this fails because Bicep complains about

This expression is being used in an assignment to the "scope" property of the "Microsoft.Authorization/roleAssignments" type, which requires a value that can be calculated at the start of the deployment. Properties of StorageAccount which can be calculated at the start include "apiVersion", "id", "type".bicep(BCP120)

Any idea how to solve this?

resource StorageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' existing = {
  name: 'demostorage'
}

param roleDefinitionIdStorageBlobDataContributor string = '...'

resource BlobStorageContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid('/', principalIdGroup, roleDefinitionIdStorageBlobDataContributor)
  scope: StorageAccount
  properties: {
    principalId: principalIdGroup
    principalType: 'Group'
    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionIdStorageBlobDataContributor)
  }
}

Thanks :)