bug: Role Assignment on custom role is not idempotent

[sriquen]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

Please paste the output of terraform version command from within the initialized directory:

1.10.2

Please enter the module version that you are using:

source  = "Azure/lz-vending/azurerm/"
version = "4.1.5"

Description

Steps to Reproduce

1. step 1
   Create a role assignment input variable using a custom role role definition id scoped on the parent management group where the subscription must be associated to (no matter to which principal id).
2. step 2
   Execute a first apply. Role Assignment on the principal id is successfully applied
3. Step 3
   Execute a second apply. Role Assignment must be replaced because on the previous apply, the Terraform state is updated with the scoped role definition id (scoped on the newly created subscription).

Expected result

No changes must be applied on the second apply.

Documentation

In the azurerm_role_assignment Terraform module, the role_definition_id must be used for custom roles and this must be SCOPED.

The Scoped-ID of the Role Definition. Changing this forces a new resource to be created. Conflicts with role_definition_name.
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment