Custom role has permission to administer resource locks

# Custom role with permission to administer resource locks
resource "azurerm_role_definition" "<example_resource_name>" {
  name  = "<example_resource_name>"
  scope = "/subscriptions/<example_resource_id>"

  permissions {
    actions = [
      "Microsoft.Authorization/locks/*" # CRITICAL: adds lock admin permission to pass the check
    ]
  }

  assignable_scopes = ["/subscriptions/<example_resource_id>"]
}

// Custom role that can administer resource locks
targetScope = 'subscription'

resource roleDef 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
  name: guid(subscription().id, '<role_name>') // CRITICAL: use GUID for role definition name
  properties: {
    roleName: '<role_name>'
    description: 'Custom role to administer resource locks'
    permissions: [
      {
        actions: [
          'Microsoft.Authorization/locks/*' // CRITICAL: grants lock administration to pass the check
        ]
        notActions: []
      }
    ]
    assignableScopes: [ subscription().id ]
  }
}