53 lines
1.8 KiB
HCL
53 lines
1.8 KiB
HCL
variable "scopes" {
|
|
type = list(string)
|
|
description = "Scope IDs at which to assign roles (subscription, resource group, resource, etc.)."
|
|
|
|
validation {
|
|
condition = (
|
|
length(var.scopes) > 0 &&
|
|
alltrue([for scope in var.scopes : scope != null && trimspace(scope) != ""]) &&
|
|
length(distinct(var.scopes)) == length(var.scopes)
|
|
)
|
|
error_message = "scopes must be a non-empty list of unique, non-empty strings."
|
|
}
|
|
}
|
|
|
|
variable "principal_id" {
|
|
type = string
|
|
description = "Object ID of the principal (service principal, user, group, managed identity)."
|
|
}
|
|
|
|
variable "roles" {
|
|
type = list(string)
|
|
default = []
|
|
description = "Unconditional role definition names to assign to principal_id at each scope in scopes."
|
|
|
|
validation {
|
|
condition = length(distinct(var.roles)) == length(var.roles)
|
|
error_message = "roles must not contain duplicates."
|
|
}
|
|
}
|
|
|
|
variable "delegable_roles" {
|
|
type = list(string)
|
|
default = []
|
|
description = "Role definition names that RBAC Administrator is allowed to assign/delete via ABAC condition. When empty, RBAC Administrator assignment is not created."
|
|
|
|
validation {
|
|
condition = length(distinct(var.delegable_roles)) == length(var.delegable_roles)
|
|
error_message = "delegable_roles must not contain duplicates."
|
|
}
|
|
}
|
|
|
|
variable "principal_type" {
|
|
type = string
|
|
default = "ServicePrincipal"
|
|
description = "Value for azurerm_role_assignment.principal_type (e.g., ServicePrincipal, User, Group)."
|
|
}
|
|
|
|
variable "delegable_roles_to_sp_only" {
|
|
type = bool
|
|
default = false
|
|
description = "When true, the RBAC Admin conditional delegation allows roleAssignments write/delete only when the target principal type is ServicePrincipal."
|
|
}
|