Terraform: provisioning via app/client id and secret

In azure portal, i have a registered app named 'terraform'.
I also created a Client Secret for this app. Lastly, the App has the role 'Cloud Application Administrator'

I would like to use this to run my terraform code which will create/provision resources. i have the following:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">=3.53.0"
    }
    azapi = {
      source = "azure/azapi"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = "<subscription_id>"
  client_id = "<client_id>"
  client_secret = "<client_secret>"
  tenant_id = "<tenant_id>"
}
provider "azapi" {
  subscription_id = "<subscription_id>"
  client_id = "<client_id>"
  client_secret = "<client_secret>"
  tenant_id = "<tenant_id>"
  use_cli = true
}

data "azurerm_container_registry" "acr" {
  name                = "container-registry"
  resource_group_name = "coreinfra-eastus-rg"
}

In the above, "container-registry" is an existing azure container registry. when i run a terraform plan, i am seeing the following:

│ Error: retrieving Registry (Subscription: "<subscription_id>"
│ Resource Group Name: "coreinfra-eastus-rg"
│ Registry Name: "container-registry"): unexpected status 403 with error: AuthorizationFailed: The client '<object_id>' with object id '<object_id>' does not have authorization to perform action 'Microsoft.ContainerRegistry/registries/read' over scope '/subscriptions/<subscription_id>/resourceGroups/coreinfra-eastus-rg/providers/Microsoft.ContainerRegistry/registries/container-registry' or the scope is invalid. If access was recently granted, please refresh your credentials.
│ 
│   with data.azurerm_container_registry.acr,
│   on data.tf line 1, in data "azurerm_container_registry" "acr":
│    1: data "azurerm_container_registry" "acr" {

In the above "<object_id>" is the id for my 'terraform' app.
How do i add the roles necessary to allow this app to broadly create/provision any cloud resources?
Is this the correct approach im taking - using an app to enable access to creation of cloud resources or is there a better approach?

'Microsoft.ContainerRegistry/registries/read'

I also created a Client Secret for this app. Lastly, the App has the role 'Cloud Application Administrator'

How do i add the roles necessary to allow this app to broadly create/provision any cloud resources?

The Cloud Application Administrator is Microsoft Entra ID role for enabling, disable, and delete devices in Microsoft Entra ID in the Azure portal.

To create or provision resources within a subscription, you may need an RBAC role at the subscription level. In your case, as you are attempting to read the container registry, it may necessitate having the Reader Role on the subscription for the service principals.

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">=3.53.0"
    }
    azapi = {
      source = "azure/azapi"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = "<subscription_id>"
  client_id = "<client_id>"
  client_secret = "<client_secret>"
  tenant_id = "<tenant_id>"
}
provider "azapi" {
  subscription_id = "<subscription_id>"
  client_id = "<client_id>"
  client_secret = "<client_secret>"
  tenant_id = "<tenant_id>"
  use_cli = true
}
data  "azurerm_container_registry"  "acr"  {
name = "venkatacrtest"
resource_group_name = "v-venkal-Mindtree"
}

After running the above Terraform code, I'm able to read the container registry.

Reference: Cloud Device Administrator

Assign Azure roles using the Azure portal