Added support for ABAC restricted roles.

variables.tf

@@ -27,7 +27,7 @@ variable "roles" {
 variable "delegable_roles" {
   type        = list(string)
   default     = []
-  description = "Role definition names that RBAC Administrator is allowed to assign/delete via ABAC condition. When empty, RBAC Administrator assignment is not created."
+  description = "Role definition names that RBAC Administrator is allowed to assign/delete via ABAC condition."
 
   validation {
     condition     = length(distinct(var.delegable_roles)) == length(var.delegable_roles)
@@ -35,6 +35,17 @@ variable "delegable_roles" {
   }
 }
 
+variable "restricted_roles" {
+  type = list(string)
+  default = []
+  description = "Role definitions names that RBAC Administrator is not allowed to assign/delete via ABAC condition."
+
+  validation {
+    condition = length(distinct(var.restricted_roles)) == length(var.restricted_roles)
+    error_message = "restricted_roles must not contain duplicates."
+  }
+}
+
 variable "principal_type" {
   type        = string
   default     = "ServicePrincipal"