How to reference custom role in policy?

[RobertPaulson90]

How to reference custom role in policy?

[RobertPaulson90]

Found the solution. I missed I was already generating the GUID myself from outside of the module so I could simply reuse that as a template to replay in the policy assignment. All is working!

[RobertPaulson90]

Ok I'm still having major issues because the actual role definition ID that is created within Azure is not the same as the GUID that I specify from terraform. This means I need to somehow fetch the role ID from state. However, I have no idea how to do that because the array containing role definitions uses the ID as resource identifiers. Please help!

  template_file_variables = {
    iops_vm_contributor_name = uuidv5("91d652b3-fdb0-48a6-8ace-f3be9e812fe1", var.environment)
    iops_vm_write_identity        = var.iam_spn_iops_vm_write_objectid
  }

{
    "name": "${iops_vm_contributor_name}",
    "type": "Microsoft.Authorization/roleDefinitions",
    "apiVersion": "2021-06-01",
    "scope": null,
    "properties": {
        "roleName": "IOPS VM Contributor",
        "type": "CustomRole",
        "description": "Grants Virtual Machine Contributor access on all resources with the IOPSManaged:true tag.",
        "permissions": [
            {
                "actions": [
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Compute/availabilitySets/*",
                    "Microsoft.Compute/locations/*",
                    "Microsoft.Compute/virtualMachines/*",

When used here the iops_vm_contributor_name cannot be found in Azure. Checking the portal the definition ID is not the same as ${iops_vm_contributor_name}. How to fetch the actual role definition ID to use in my policy?

{
    "name": "Deploy-IOPSAssignRole",
    "type": "Microsoft.Authorization/policyAssignments",
    "apiVersion": "2021-06-01",
    "properties": {
        "description": "Assigns the IOPS VM Contributor role to specific resources with the IOPSManaged:true tag.",
        "displayName": "Assign IOPS VM Contributor Role if Tag Exists",
        "notScopes": [],
        "parameters": {
            "roleDefinitionId": {
                "value": "${iops_vm_contributor_name}"
            },
            "principalId": {
                "value": "${iops_vm_write_identity}"
            }
        },
        "policyDefinitionId": "${root_scope_resource_id}/providers/Microsoft.Authorization/policyDefinitions/Deploy-IOPSAssignRole",
        "scope": "${current_scope_resource_id}",