Reverted multiple-scope due to complexity introduced. Added ability to restrict assignments to ServicePrincipal only.

variables.tf

@@ -1,14 +1,10 @@
-variable "scopes" {
-  type        = list(string)
-  description = "Scope IDs at which to assign roles (subscription, resource group, resource, etc.)."
+variable "scope" {
+  type        = string
+  description = "Scope ID at which to assign roles (subscription, resource group, resource, etc.)."
 
   validation {
-    condition = (
-      length(var.scopes) > 0 &&
-      alltrue([for scope in var.scopes : scope != null && trimspace(scope) != ""]) &&
-      length(distinct(var.scopes)) == length(var.scopes)
-    )
-    error_message = "scopes must be a non-empty list of unique, non-empty strings."
+    condition     = var.scope != null && trimspace(var.scope) != ""
+    error_message = "scope must be a non-empty string."
   }
 }
 
@@ -20,7 +16,7 @@ variable "principal_id" {
 variable "roles" {
   type        = list(string)
   default     = []
-  description = "Unconditional role definition names to assign to principal_id at each scope in scopes."
+  description = "Unconditional role definition names to assign to principal_id at scope."
 
   validation {
     condition     = length(distinct(var.roles)) == length(var.roles)