Exhibit:

resource "azurerm_linux_web_app" "app" {

name = "example-app"

resource_group_name = azurerm_resource_group.rg.name

location = azurerm_resource_group.rg.location

service_plan_id = azurerm_service_plan.plan.id

identity {

type = "UserAssigned"

identity_ids = [azurerm_user_assigned_identity.app.id]

}

}

resource "azurerm_role_assignment" "kv_access" {

scope = azurerm_key_vault.kv.id

role_definition_name = "Key Vault Secrets User"

principal_id = azurerm_user_assigned_identity.app.principal_id

}

Two resource blocks are shown: azurerm_linux_web_app and azurerm_role_assignment. When provisioned, the web app will use the role assignment during creation, so the role assignment must be created first. How do you ensure the azurerm_role_assignment resource is created first?