What IAM permissions does a Terraform service principal actually need for AKS?

At minimum: Contributor role on the resource group for cluster and node pool management, plus Azure Kubernetes Service Cluster Admin Role if Terraform also manages RBAC-controlled Kubernetes resources via the AKS provider.

Security note

Avoid granting Owner or subscription-level Contributor purely for convenience — scope the service principal to the specific resource group(s) it manages, and rotate its credentials on the same cadence as other privileged service accounts.