Terraform azurerm backend using ACL and not RBAC - terraform

Question

I am trying to automate Azure Databricks SQL permissions using Terraform.
I am using Azure Data Lake Gen 2 (Azure storage with hierarchical namespace enabled) as the backend to store the state file.
Terraform , as per my understanding and based on the tests that I have performed only uses the backend resource to store the state file. This operation SHOULD NOT need "owner" permissions. It should be ok to use ACL permissions on the container or a folder that I am trying to write the state file in.
For authentication, I am using a Service Principal (with a secret, for now).
However, though it works when I assign that Service Principal Owner rights on the Data Lake. If I just assign the Service Principal "ACL" permissions on the container or the folder , it fails when doing terraform init.
Error inspecting states in the "azurerm" backend:
Error retrieving keys for Storage Account "datalakename": storage.AccountsClient#ListKeys:
Failure responding to request: StatusCode=403 --
Original Error: autorest/azure: Service returned an error.
Status=403 Code="AuthorizationFailed"
Message="The client 'client guid' with object id 'object id' does not have authorization to perform
action 'Microsoft.Storage/storageAccounts/listKeys/action' over scope '/subscriptions/subscriptionid/resourceGroups/adobe/providers/Microsoft.Storage/storageAccounts/datalakename' or the scope is invalid. If access was recently granted, please refresh your credentials."
My backend configuration looks like this
terraform {
backend "azurerm"{
resource_group_name = "RGname"
storage_account_name = "datalakename"
container_name = "raw"
key = "prod.terraform.tfstate"
subscription_id = "subscrioption id here"
tenant_id = "tenant id here"
}
}
Also, I have the SPN details in the environment variables
export ARM_CLIENT_ID="client id here";
export ARM_CLIENT_SECRET="client secret here";
export ARM_SUBSCRIPTION_ID="subscription id here";
Like I said if I assign the "client id" the RBAC role of owner on the datalake, it works.
But question is why does it try to do a "listing keys of the storage account" action when I am using client credentials for authentication (and not keys) and why does it need an RBAC role to just save a file?