Create app service and add app configuration data reader role.

AppServiceWithAppConfigurationRole.bicep

resource plan 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: 'plan-demo-lab'
  location: resourceGroup().location
  kind: 'app'
  sku: {
    name: 'B1'
  }
}

resource app 'Microsoft.Web/sites@2022-03-01' = {
  name: 'app-demo'
  location: resourceGroup().location
  kind: 'app'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    serverFarmId: plan.id
  }
}

var roleDefinitionAppConfigurationDataReader = subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '516239f1-63e1-4d78-a4de-a74fb236a071')
resource managedId 'Microsoft.Authorization/roleAssignments@2020-10-01-preview' = {
  name: guid(app.name, app.id, roleDefinitionAppConfigurationDataReader)
  properties: {
    principalId: app.identity.principalId
    principalType: 'ServicePrincipal'
    roleDefinitionId: roleDefinitionAppConfigurationDataReader
  }
}