Access issue while using BlobServiceClientBuilder for accessing blob storage container details

Hi,

I am trying to verify the existence of Azure Blob Storage Container in my scala code (via java sdk). I am trying to do something like this below:

val azureCredential = new ClientCertificateCredentialBuilder()
      .pemCertificate(spPEMCertPath)
      .tenantId(tenantId)
      .clientId(spApplicationId)
      .authorityHost(azureEnvironments(azureEnvironment).getActiveDirectoryEndpoint)
      .sendCertificateChain(true)
      .build()
    val backupContainerName = "backup-data"
    try {
      val containerClient = blobServiceClient.getBlobContainerClient(backupContainerName)
      val context = new Context("Azure-Storage-Log-String-To-Sign", true)
      val timeout = Duration.ofSeconds(30)
      val containerExists = containerClient.existsWithResponse(timeout, context).getValue
      if (containerExists) {
        logger.info(s"Container '$backupContainerName' exists.")
        true
      } else {
        logger.info(s"Container '$backupContainerName' does not exist.")
        false
      }
    } catch {
      case e: BlobStorageException =>
        logger.error(s"Error occurred: ${e.getMessage}")
        false
    }

I see my service principal have Contributor role assigned which should be sufficient for checking the container existence, still I am running into access issues and getting below error:

If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call. If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call. Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII. Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationFailure</Code><Message>This request is not authorized to perform this operation.

Please could you help here if I am doing something incorrect?