The following arguments are supported:
NOTE:
The value for scope is automatically included in this list if no other values supplied.
A permissions block as the following properties:
data "azurerm_subscription" "primary" {
}
resource "azurerm_role_definition" "example" {
name = "my-custom-role"
scope = data.azurerm_subscription.primary.id
description = "This is a custom role created via Terraform"
permissions {
actions = ["*"]
not_actions = []
}
assignable_scopes = [
data.azurerm_subscription.primary.id, # /subscriptions/00000000-0000-0000-0000-000000000000
]
}
az role definition create --role-definition
az role definition create --role-definition '{
"Name": "Contoso On-call",
"Description": "Perform VM actions and read storage and network information.",
"Actions": [
"Microsoft.Compute/*/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Network/*/read",
"Microsoft.Storage/*/read",
"Microsoft.Authorization/*/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourceGroups/resources/read",
"Microsoft.Insights/alertRules/*",
"Microsoft.Support/*"
],
"DataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*"
],
"NotDataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
],
"AssignableScopes": ["/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]
}'
Categorized by Availability, Security & Compliance and Cost
.svg){kind=icon}
