"az storage account create" doesn't give enough permissions to do the simple stuff

I created a storage account using the CLI and then tried to do the simple things like create a container and upload a blob to it using the data plane. I could create the container but I could not upload a blob to it. I had to go in and explicitly add "Storage Blob Data Owner" permissions. This is not discoverable and was extremely frustrating to try to figure out why it wasn't working.