role_definitions

Creates, updates, deletes, gets or lists a role_definitions resource.

Overview

Name	role_definitions
Type	Resource
Id	azure.key_vault_administration.role_definitions

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	The role definition ID.
name	string	The role definition name.
assignableScopes	array	Role definition assignable scopes.
description	string	The role definition description.
permissions	array	Role definition permissions.
roleName	string	The role name.
type	string	The role definition type. "Microsoft.Authorization/roleDefinitions" (Microsoft.Authorization/roleDefinitions)

list

Name	Datatype	Description
id	string	The role definition ID.
name	string	The role definition name.
assignableScopes	array	Role definition assignable scopes.
description	string	The role definition description.
permissions	array	Role definition permissions.
roleName	string	The role name.
type	string	The role definition type. "Microsoft.Authorization/roleDefinitions" (Microsoft.Authorization/roleDefinitions)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	scope, role_definition_name, vault_base_url		Get the specified role definition.
list	select	scope, vault_base_url	$filter	Get all role definitions that are applicable at scope and above.
create_or_update	insert	scope, role_definition_name, vault_base_url, properties		Creates or updates a custom role definition.
create_or_update	replace	scope, role_definition_name, vault_base_url, properties		Creates or updates a custom role definition.
delete	delete	scope, role_definition_name, vault_base_url		Deletes a custom role definition.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
role_definition_name	string	The name (GUID) of the role definition to delete. Required.
scope	string	The scope of the role definition to delete. Managed HSM only supports '/'. Required.
vault_base_url	string	The service endpoint host (no scheme), e.g. myaccount.table.cosmos.azure.com:443 - value of the client vaultBaseUrl parameter. (default: )
$filter	string	The filter to apply on the operation. Use atScopeAndBelow filter to search below the given scope as well. Default value is None.

SELECT examples

get

Get the specified role definition.

SELECT
id,
name,
assignableScopes,
description,
permissions,
roleName,
type
FROM azure.key_vault_administration.role_definitions
WHERE scope = '{{ scope }}' -- required
AND role_definition_name = '{{ role_definition_name }}' -- required
AND vault_base_url = '{{ vault_base_url }}' -- required
;

list

Get all role definitions that are applicable at scope and above.

SELECT
id,
name,
assignableScopes,
description,
permissions,
roleName,
type
FROM azure.key_vault_administration.role_definitions
WHERE scope = '{{ scope }}' -- required
AND vault_base_url = '{{ vault_base_url }}' -- required
AND $filter = '{{ $filter }}'
;

INSERT examples

create_or_update

Creates or updates a custom role definition.

INSERT INTO azure.key_vault_administration.role_definitions (
properties,
scope,
role_definition_name,
vault_base_url
)
SELECT 
'{{ properties }}' /* required */,
'{{ scope }}',
'{{ role_definition_name }}',
'{{ vault_base_url }}'
RETURNING
id,
name,
properties,
type
;

Manifest

# Description fields are for documentation purposes
- name: role_definitions
props:
  - name: scope
    value: "{{ scope }}"
    description: Required parameter for the role_definitions resource.
  - name: role_definition_name
    value: "{{ role_definition_name }}"
    description: Required parameter for the role_definitions resource.
  - name: vault_base_url
    value: "{{ vault_base_url }}"
    description: Required parameter for the role_definitions resource.
  - name: properties
    description: |
      Role definition properties. Required.
    value:
      roleName: "{{ roleName }}"
      description: "{{ description }}"
      type: "{{ type }}"
      permissions:
        - actions: "{{ actions }}"
          notActions: "{{ notActions }}"
          dataActions: "{{ dataActions }}"
          notDataActions: "{{ notDataActions }}"
      assignableScopes:
        - "{{ assignableScopes }}"

REPLACE examples

create_or_update

Creates or updates a custom role definition.

REPLACE azure.key_vault_administration.role_definitions
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND role_definition_name = '{{ role_definition_name }}' --required
AND vault_base_url = '{{ vault_base_url }}' --required
AND properties = '{{ properties }}' --required
RETURNING
id,
name,
properties,
type;

DELETE examples

delete

Deletes a custom role definition.

DELETE FROM azure.key_vault_administration.role_definitions
WHERE scope = '{{ scope }}' --required
AND role_definition_name = '{{ role_definition_name }}' --required
AND vault_base_url = '{{ vault_base_url }}' --required
;