Custom role is not a subscription owner role

# Define a custom role without using the global "*" action
resource "azurerm_role_definition" "<example_resource_name>" {
  name  = "<example_resource_name>"
  scope = "/subscriptions/<example_subscription_id>"

  permissions {
    actions = ["Microsoft.Resources/subscriptions/resourceGroups/read"] # CRITICAL: do not use "*"; specify only required actions
  }

  assignable_scopes = ["/subscriptions/<example_subscription_id>"]
}

// Subscription-scoped deployment to ensure the custom role does not use global "*" permissions
targetScope = 'subscription'

resource roleDef 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
  name: guid(subscription().id, '<role_name>') // CRITICAL: use GUID for role definition name
  properties: {
    roleName: '<role_name>'
    description: 'Restricted custom role'
    assignableScopes: [
      subscription().id
    ]
    permissions: [
      {
        actions: [
          'Microsoft.Resources/subscriptions/resourceGroups/read' // CRITICAL: remove "*" and allow only specific actions to avoid owner-equivalent wildcard
        ]
        notActions: []
        dataActions: []
        notDataActions: []
      }
    ]
  }
}