Enhance the module to allow multiple scope assignments.

README.md

@@ -12,7 +12,7 @@ The constrained RBAC Administrator assignment is created only when `delegable_ro
 module "iam" {
   source = "../modules/simple-iam"
 
-  scope        = data.azurerm_subscription.current.id
+  scopes       = [data.azurerm_subscription.current.id]
   principal_id = azuread_service_principal.sp.object_id
 
   roles = [
@@ -32,14 +32,15 @@ module "iam" {
 
 ## Inputs
 
-- `scope` (string): Scope ID at which to assign roles.
+- `scopes` (list(string)): Scope IDs at which to assign roles.
 - `principal_id` (string): Object ID of the principal.
-- `roles` (list(string)): Unconditional role definition names to assign.
+- `roles` (list(string)): Unconditional role definition names to assign at each scope in `scopes`.
 - `delegable_roles` (list(string)): Role definition names allowed by the constrained RBAC Admin condition. When empty, RBAC Admin is not assigned.
 - `principal_type` (string): Passed to `azurerm_role_assignment.principal_type`.
+- `delegable_roles_to_sp_only` (bool): When true, RBAC Admin delegation can only assign/delete roles to principals of type ServicePrincipal.
 
 ## Outputs
 
 - `role_assignment_ids` (map(string))
-- `rbac_admin_role_assignment_id` (string|null)
+- `rbac_admin_role_assignment_id` (map(string))
 - `rbac_admin_condition` (string|null)