Azure Authorization Definition

azurerm_role_definition (Terraform)

The Definition in Authorization can be configured in Terraform with the resource name azurerm_role_definition. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

dasalebr/azurepipeline_shiftleft

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

olmorigolo/terraform

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

prancer-io/prancer-terramerra

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.primary.id
  description = "This is a custom role created via Terraform"

  permissions {

rogeriopeixotocx/test-kics-circle

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

amit894/tf-aks-modules

resource "azurerm_role_definition" "network_admin" {
  role_definition_id = "00000000-0000-0000-0000-000000000001"
  name               = "network-admin-role"
  scope              = var.network_resource_group_id

  permissions {

asafsh-cp/teraform

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

mikeh-hmh/Bridgecrew

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

StEustache/TP-Cloud

resource "azurerm_role_definition" "example" {
  name        = "my_custom_role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

masanchezp/terragoat

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

shunsuke-shiota/IaC_test

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.current_subscription.id
  description = "This is a custom role created via Terraform"

  permissions {

Security Best Practices for azurerm_role_definition

There is 1 setting in azurerm_role_definition that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure to grant targeted permissions for roles

It is better to avoid giving too many permissions to a role. By following the principle of least privilege, you can reduce the risk of credential leakage.

Parameters

• assignable_scopes optional computed - list of string
• description optional - string
• id optional computed - string
• name required - string
• role_definition_id optional computed - string
• role_definition_resource_id optional computed - string
• scope required - string
• permissions list block
  • actions optional - list of string
  • data_actions optional - set of string
  • not_actions optional - list of string
  • not_data_actions optional - set of string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages a custom Role Definition, used to assign Roles to Users/Principals. See 'Understand role definitions' in the Azure documentation for more details.