Skip to content
Draft
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions modules/azure-customrole/.terraform-docs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
formatter: "markdown" # this is required

version: ""

header-from: docs/header.md
footer-from: docs/footer.md

recursive:
enabled: false
path: modules
include-main: true

sections:
hide: []
show: []

content: ""

output:
file: "README.md"
mode: inject
template: |-
<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->

output-values:
enabled: false
from: ""

sort:
enabled: true
by: name

settings:
anchor: true
color: true
default: true
description: false
escape: true
hide-empty: false
html: true
indent: 2
lockfile: true
read-comments: true
required: true
sensitive: true
type: true
102 changes: 61 additions & 41 deletions modules/azure-customrole/README.md
Original file line number Diff line number Diff line change
@@ -1,66 +1,86 @@
<!-- BEGIN_TF_DOCS -->
# Azure Custom Role Terraform Module

## Overview

This Terraform module allows you to create a custom role in Azure, specifying actions, data actions, and the assignable scopes.

## Main features
- Create custom roles in Azure.
- Flexible definition of actions, data actions, not actions, and not data actions.
- Support for multiple assignable scopes.

## Ejemplo completo

Puedes encontrar un ejemplo completo en [`_examples/basic/values.yaml`](../\_examples/basic/values.yaml).

## File structure

```
.
├── main.tf
├── variables.tf
├── outputs.tf
├── versions.tf
├── README.md
├── CHANGELOG.md
└── docs/
├── header.md
└── footer.md
```

## Requirements

| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.7.5 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.7.0 |
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~> 4.16.0 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | ~= 4.16.0 |
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | ~> 4.16.0 |

## Modules

No modules.

## Resources

| Name | Type |
|------|------|
| [azurerm_role_definition](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | source |
| [azurerm_role_definition.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition) | resource |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| name | The name of the Role Definition | `string` | n/a | yes |
| assignable_scopes | One or more assignable scopes for this Role Definition. The first one will become de scope at which the Role Definition applies to. | `list(string)` | n/a | yes |
| permissions | A permissions block with possible 'actions', 'data_actions', 'not_actions' and/or 'not_data_actions'. | <pre>object({<br> actions = list(string) (optional)<br> data_actions = list(string) (optional)<br> not_actions = list(string) (optional)<br> not_data_actions = list(string) (optional)<br>})</pre> | n/a | yes |
| <a name="input_assignable_scopes"></a> [assignable\_scopes](#input\_assignable\_scopes) | One or more assignable scopes for this Role Definition. The first one will become de scope at which the Role Definition applies to. | `list(string)` | n/a | yes |
| <a name="input_name"></a> [name](#input\_name) | The name of the Role Definition | `string` | n/a | yes |
| <a name="input_permissions"></a> [permissions](#input\_permissions) | A permissions block with possible 'actions', 'data\_actions', 'not\_actions' and/or 'not\_data\_actions'. | <pre>object({<br/> actions = optional(list(string), [])<br/> data_actions = optional(list(string), [])<br/> not_actions = optional(list(string), [])<br/> not_data_actions = optional(list(string), [])<br/> })</pre> | n/a | yes |

## Outputs

| Name | Description |
|------|-------------|
| <a name="output_role_definition_id"></a> [role_definition_id](#output\_role\_definition\_id"></a>) | The ID of the Role Definition. |

## Example

### HCL
```hcl
{
name: "Custom Role"
assignable_scopes: ["yyy", "zzz"]
permissions: {
actions = [
"Microsoft.Compute/disks/read",
"Microsoft.Compute/disks/write",
]
not_actions = [
"Microsoft.Compute/disks/read",
"Microsoft.Compute/disks/write",
]
}
}
```
| <a name="output_id"></a> [id](#output\_id) | # OUTPUTS SECTION Role Definition Id |
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The output description appears to be a placeholder (# OUTPUTS SECTION ...) and the leading # may also render oddly inside a Markdown table. Replace it with a user-facing description (e.g., what the id represents) consistent with the rest of the README.

Suggested change
| <a name="output_id"></a> [id](#output\_id) | # OUTPUTS SECTION Role Definition Id |
| <a name="output_id"></a> [id](#output\_id) | The ID of the created custom role definition. |

Copilot uses AI. Check for mistakes.

### Yaml
```yaml
name: "Custom Role"
assignable_scopes:
- "yyy"
- "zzz"
permissions:
actions:
- "Microsoft.Compute/disks/read"
- "Microsoft.Compute/disks/write"
notActions:
- "Microsoft.Authorization/*/Delete"
- "Microsoft.Authorization/*/Write"
```
---

## Examples

For detailed examples, refer to the [module examples](https://github.com/prefapp/tfm/tree/main/modules/azure-customrole/_examples):

- [basic](https://github.com/prefapp/tfm/tree/main/modules/azure-customrole/_examples/basic) - Basic custom role definition with assignable scopes and permissions.

## Additional resources

- [Azure Custom Roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles)
- [Terraform AzureRM Provider - azurerm\_role\_definition](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition)
- [Official Terraform documentation](https://www.terraform.io/docs)

## Support

For issues, questions, or contributions related to this module, please visit the [repository's issue tracker](https://github.com/prefapp/tfm/issues).
<!-- END_TF_DOCS -->
6 changes: 6 additions & 0 deletions modules/azure-customrole/_examples/basic/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
module "custom_role" {
source = "../../"
name = var.name
assignable_scopes = var.assignable_scopes
permissions = var.permissions
}
11 changes: 11 additions & 0 deletions modules/azure-customrole/_examples/basic/values.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
name: "Custom Role"
assignable_scopes:
- "/subscriptions/xxx"
- "/subscriptions/yyy"
permissions:
actions:
- "Microsoft.Compute/disks/read"
- "Microsoft.Compute/disks/write"
notActions:
- "Microsoft.Authorization/*/Delete"
- "Microsoft.Authorization/*/Write"
17 changes: 17 additions & 0 deletions modules/azure-customrole/docs/footer.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
---

## Examples

For detailed examples, refer to the [module examples](https://github.com/prefapp/tfm/tree/main/modules/azure-customrole/_examples):

- [basic](https://github.com/prefapp/tfm/tree/main/modules/azure-customrole/_examples/basic) - Basic custom role definition with assignable scopes and permissions.

## Additional resources

- [Azure Custom Roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles)
- [Terraform AzureRM Provider - azurerm_role_definition](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_definition)
- [Official Terraform documentation](https://www.terraform.io/docs)

## Support

For issues, questions, or contributions related to this module, please visit the [repository's issue tracker](https://github.com/prefapp/tfm/issues).
29 changes: 29 additions & 0 deletions modules/azure-customrole/docs/header.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# Azure Custom Role Terraform Module

## Overview

This Terraform module allows you to create a custom role in Azure, specifying actions, data actions, and the assignable scopes.

## Main features
- Create custom roles in Azure.
- Flexible definition of actions, data actions, not actions, and not data actions.
- Support for multiple assignable scopes.

## Ejemplo completo

Puedes encontrar un ejemplo completo en [`_examples/basic/values.yaml`](../_examples/basic/values.yaml).

## File structure

```
.
├── main.tf
├── variables.tf
├── outputs.tf
├── versions.tf
├── README.md
├── CHANGELOG.md
└── docs/
├── header.md
└── footer.md
```