This module outputs a simple map of role definition role names to UUIDs and resource IDs.
It rationalizes the resource ID to be either tenant root scoped or subscription scoped, depending on the input variable role_definition_scope. This helps with getting idempotent role assignment resources.
There is an option to use live data from Azure or cached data within the module, which is updated regularly with built-in roles.
The following requirements are needed by this module:
The following resources are used by this module:
- modtm_telemetry.telemetry (resource)
- random_uuid.telemetry (resource)
- azapi_client_config.current (data source)
- azapi_client_config.telemetry (data source)
- azapi_resource_list.role_definitions (data source)
- modtm_module_source.telemetry (data source)
No required inputs.
The following input variables are optional (have default values):
Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.
Type: bool
Default: true
Description: Serves two purposes. First, if using live data, it defines the scope at which to fetch role definitions.
Second it prepends the scope to the role definition ID output, this will be either the tenant root scope or a subscription scope - see output documentation.
Type: string
Default: null
Description: If true, use the cached role definition data. If false, fetch live data from Azure.
Type: bool
Default: true
The following outputs are exported:
Description: A map of role definition role names, e.g. 'Contributor', to role definition names (UUIDs).
Description: A map of role definition role names, e.g. 'Contributor', to role definition resource IDs.
The resource ID returned will be tenant scoped or subscription scoped, depending on the value of the role_definition_scope input variable.
- If the
role_definition_scopeinput variable is not set, the resource ID will be subscription scoped. - If the
role_definition_scopeinput variable is set to a management group, the resource ID will be tenant scoped. - If the
role_definition_scopeinput variable is set to a subscription, the resource ID will be subscription scoped.
The following Modules are called:
Source: ./modules/cached-data
Version:
The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.