role_definitions

Creates, updates, deletes, gets or lists a role_definitions resource.

Overview

Name	role_definitions
Type	Resource
Id	azure.authorization.role_definitions

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignableScopes	array	Role definition assignable scopes.
createdBy	string	Id of the user who created the assignment.
createdOn	string (date-time)	Time it was created.
description	string	The role definition description.
permissions	array	Role definition permissions.
roleName	string	The role name.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updatedBy	string	Id of the user who updated the assignment.
updatedOn	string (date-time)	Time it was updated.

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignableScopes	array	Role definition assignable scopes.
createdBy	string	Id of the user who created the assignment.
createdOn	string (date-time)	Time it was created.
description	string	The role definition description.
permissions	array	Role definition permissions.
roleName	string	The role name.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updatedBy	string	Id of the user who updated the assignment.
updatedOn	string (date-time)	Time it was updated.

get_by_id

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignableScopes	array	Role definition assignable scopes.
createdBy	string	Id of the user who created the assignment.
createdOn	string (date-time)	Time it was created.
description	string	The role definition description.
permissions	array	Role definition permissions.
roleName	string	The role name.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updatedBy	string	Id of the user who updated the assignment.
updatedOn	string (date-time)	Time it was updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	scope, role_definition_id		Get role definition by ID (GUID).
list	select	scope	$filter	Get all role definitions that are applicable at scope and above.
get_by_id	select	role_id		Gets a role definition by ID.
create_or_update	insert	scope, role_definition_id		Creates or updates a role definition.
create_or_update	replace	scope, role_definition_id		Creates or updates a role definition.
delete	delete	scope, role_definition_id		Deletes a role definition.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
role_definition_id	string	The ID of the role definition. Required.
role_id	string	The fully qualified role definition ID. Use the format, /subscriptions/{guid}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for subscription level role definitions, or /providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for tenant level role definitions. Required.
scope	string	The fully qualified Azure Resource manager identifier of the resource. Required.
$filter	string	The filter to apply on the operation. Use atScopeAndBelow filter to search below the given scope as well. Default value is None.

SELECT examples

get

Get role definition by ID (GUID).

SELECT
id,
name,
assignableScopes,
createdBy,
createdOn,
description,
permissions,
roleName,
systemData,
type,
updatedBy,
updatedOn
FROM azure.authorization.role_definitions
WHERE scope = '{{ scope }}' -- required
AND role_definition_id = '{{ role_definition_id }}' -- required
;

list

Get all role definitions that are applicable at scope and above.

SELECT
id,
name,
assignableScopes,
createdBy,
createdOn,
description,
permissions,
roleName,
systemData,
type,
updatedBy,
updatedOn
FROM azure.authorization.role_definitions
WHERE scope = '{{ scope }}' -- required
AND $filter = '{{ $filter }}'
;

get_by_id

Gets a role definition by ID.

SELECT
id,
name,
assignableScopes,
createdBy,
createdOn,
description,
permissions,
roleName,
systemData,
type,
updatedBy,
updatedOn
FROM azure.authorization.role_definitions
WHERE role_id = '{{ role_id }}' -- required
;

INSERT examples

create_or_update

Creates or updates a role definition.

INSERT INTO azure.authorization.role_definitions (
properties,
scope,
role_definition_id
)
SELECT 
'{{ properties }}',
'{{ scope }}',
'{{ role_definition_id }}'
RETURNING
id,
name,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: role_definitions
props:
  - name: scope
    value: "{{ scope }}"
    description: Required parameter for the role_definitions resource.
  - name: role_definition_id
    value: "{{ role_definition_id }}"
    description: Required parameter for the role_definitions resource.
  - name: properties
    description: |
      Role definition properties.
    value:
      roleName: "{{ roleName }}"
      description: "{{ description }}"
      type: "{{ type }}"
      permissions:
        - actions: "{{ actions }}"
          notActions: "{{ notActions }}"
          dataActions: "{{ dataActions }}"
          notDataActions: "{{ notDataActions }}"
          condition: "{{ condition }}"
          conditionVersion: "{{ conditionVersion }}"
      assignableScopes:
        - "{{ assignableScopes }}"
      createdOn: "{{ createdOn }}"
      updatedOn: "{{ updatedOn }}"
      createdBy: "{{ createdBy }}"
      updatedBy: "{{ updatedBy }}"

REPLACE examples

create_or_update

Creates or updates a role definition.

REPLACE azure.authorization.role_definitions
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND role_definition_id = '{{ role_definition_id }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples

delete

Deletes a role definition.

DELETE FROM azure.authorization.role_definitions
WHERE scope = '{{ scope }}' --required
AND role_definition_id = '{{ role_definition_id }}' --required
;