This Terraform module assigns BUILT IN roles to users, groups and service principals.
NOTE: Assigning the same role to the same user, group or service principal multiple times will merge it, so when you do:
module "role_assignments" {
source = "retoxx-dev/role-assignment/azurerm"
role_assignments = [
{
user_principal_names = ["[email protected]"]
role_names = ["Reader", "Web Plan Contributor"]
scope = azurerm_resource_group.this.id
},
{
user_principal_names = ["[email protected]", "[email protected]"]
role_names = ["Reader", "Owner"]
scope = azurerm_resource_group.this.id
}
]
}The role Reader will be assigned to [email protected] only once.
module "role_assignments" {
source = "retoxx-dev/role-assignment/azurerm"
role_assignments = [
{
user_principal_names = ["[email protected]", "[email protected]"]
role_names = ["Reader", "Web Plan Contributor"]
scope = azurerm_resource_group.this.id
}
]
}module "role_assignments" {
source = "retoxx-dev/role-assignment/azurerm"
role_assignments = [
{
group_names = ["group1", "group2", "group3"]
role_names = ["Reader", "Web Plan Contributor"]
scope = azurerm_resource_group.this.id
}
]
}module "role_assignments" {
source = "retoxx-dev/role-assignment/azurerm"
role_assignments = [
{
sp_names = ["spname1", "spname2", "spname3"]
role_names = ["Reader", "Web Plan Contributor"]
scope = azurerm_resource_group.this.id
}
]
}module "role_assignments" {
source = "retoxx-dev/role-assignment/azurerm"
role_assignments = [
{
principal_ids = ["00000000-0000-0000-0000-000000000000"]
role_names = ["Reader", "Web Plan Contributor"]
scope = azurerm_resource_group.this.id
}
]
}| Name | Version |
|---|---|
| terraform | >= 1.3.1 |
| azuread | >=2.37 |
| azurerm | >=3.33 |
| Name | Version |
|---|---|
| azuread | >=2.37 |
| azurerm | >=3.33 |
No modules.
| Name | Type |
|---|---|
| azurerm_role_assignment.groups | resource |
| azurerm_role_assignment.principal_ids | resource |
| azurerm_role_assignment.service_principals | resource |
| azurerm_role_assignment.users | resource |
| azuread_group.group_objects | data source |
| azuread_service_principal.sp_objects | data source |
| azuread_user.user_objects | data source |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| role_assignments | The role assignments to create | list(object({ |
n/a | yes |
No outputs.