using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
    public MyStack()
    {
        var current = Output.Create(Azure.Core.GetClientConfig.InvokeAsync());
        var exampleResourceGroup = new Azure.Core.ResourceGroup("exampleResourceGroup", new Azure.Core.ResourceGroupArgs
        {
            Location = "West Europe",
        });
        var exampleAccount = new Azure.CosmosDB.Account("exampleAccount", new Azure.CosmosDB.AccountArgs
        {
            Location = exampleResourceGroup.Location,
            ResourceGroupName = exampleResourceGroup.Name,
            OfferType = "Standard",
            Kind = "GlobalDocumentDB",
            ConsistencyPolicy = new Azure.CosmosDB.Inputs.AccountConsistencyPolicyArgs
            {
                ConsistencyLevel = "Strong",
            },
            GeoLocations = 
            {
                new Azure.CosmosDB.Inputs.AccountGeoLocationArgs
                {
                    Location = exampleResourceGroup.Location,
                    FailoverPriority = 0,
                },
            },
        });
        var exampleSqlRoleDefinition = new Azure.CosmosDB.SqlRoleDefinition("exampleSqlRoleDefinition", new Azure.CosmosDB.SqlRoleDefinitionArgs
        {
            RoleDefinitionId = "84cf3a8b-4122-4448-bce2-fa423cfe0a15",
            ResourceGroupName = exampleResourceGroup.Name,
            AccountName = exampleAccount.Name,
            AssignableScopes = 
            {
                Output.Tuple(current, exampleResourceGroup.Name, exampleAccount.Name).Apply(values =>
                {
                    var current = values.Item1;
                    var exampleResourceGroupName = values.Item2;
                    var exampleAccountName = values.Item3;
                    return $"/subscriptions/{current.SubscriptionId}/resourceGroups/{exampleResourceGroupName}/providers/Microsoft.DocumentDB/databaseAccounts/{exampleAccountName}/dbs/sales";
                }),
            },
            Permissions = 
            {
                new Azure.CosmosDB.Inputs.SqlRoleDefinitionPermissionArgs
                {
                    DataActions = 
                    {
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read",
                    },
                },
            },
        });
    }

}

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/cosmosdb"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := core.GetClientConfig(ctx, nil, nil)
		if err != nil {
			return err
		}
		exampleResourceGroup, err := core.NewResourceGroup(ctx, "exampleResourceGroup", &core.ResourceGroupArgs{
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleAccount, err := cosmosdb.NewAccount(ctx, "exampleAccount", &cosmosdb.AccountArgs{
			Location:          exampleResourceGroup.Location,
			ResourceGroupName: exampleResourceGroup.Name,
			OfferType:         pulumi.String("Standard"),
			Kind:              pulumi.String("GlobalDocumentDB"),
			ConsistencyPolicy: &cosmosdb.AccountConsistencyPolicyArgs{
				ConsistencyLevel: pulumi.String("Strong"),
			},
			GeoLocations: cosmosdb.AccountGeoLocationArray{
				&cosmosdb.AccountGeoLocationArgs{
					Location:         exampleResourceGroup.Location,
					FailoverPriority: pulumi.Int(0),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = cosmosdb.NewSqlRoleDefinition(ctx, "exampleSqlRoleDefinition", &cosmosdb.SqlRoleDefinitionArgs{
			RoleDefinitionId:  pulumi.String("84cf3a8b-4122-4448-bce2-fa423cfe0a15"),
			ResourceGroupName: exampleResourceGroup.Name,
			AccountName:       exampleAccount.Name,
			AssignableScopes: pulumi.StringArray{
				pulumi.All(exampleResourceGroup.Name, exampleAccount.Name).ApplyT(func(_args []interface{}) (string, error) {
					exampleResourceGroupName := _args[0].(string)
					exampleAccountName := _args[1].(string)
					return fmt.Sprintf("%v%v%v%v%v%v%v", "/subscriptions/", current.SubscriptionId, "/resourceGroups/", exampleResourceGroupName, "/providers/Microsoft.DocumentDB/databaseAccounts/", exampleAccountName, "/dbs/sales"), nil
				}).(pulumi.StringOutput),
			},
			Permissions: cosmosdb.SqlRoleDefinitionPermissionArray{
				&cosmosdb.SqlRoleDefinitionPermissionArgs{
					DataActions: pulumi.StringArray{
						pulumi.String("Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import java.util.*;
import java.io.*;
import java.nio.*;
import com.pulumi.*;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = Output.of(CoreFunctions.getClientConfig());

        var exampleResourceGroup = new ResourceGroup("exampleResourceGroup", ResourceGroupArgs.builder()        
            .location("West Europe")
            .build());

        var exampleAccount = new Account("exampleAccount", AccountArgs.builder()        
            .location(exampleResourceGroup.location())
            .resourceGroupName(exampleResourceGroup.name())
            .offerType("Standard")
            .kind("GlobalDocumentDB")
            .consistencyPolicy(AccountConsistencyPolicyArgs.builder()
                .consistencyLevel("Strong")
                .build())
            .geoLocations(AccountGeoLocationArgs.builder()
                .location(exampleResourceGroup.location())
                .failoverPriority(0)
                .build())
            .build());

        var exampleSqlRoleDefinition = new SqlRoleDefinition("exampleSqlRoleDefinition", SqlRoleDefinitionArgs.builder()        
            .roleDefinitionId("84cf3a8b-4122-4448-bce2-fa423cfe0a15")
            .resourceGroupName(exampleResourceGroup.name())
            .accountName(exampleAccount.name())
            .assignableScopes(Output.tuple(exampleResourceGroup.name(), exampleAccount.name()).apply(values -> {
                var exampleResourceGroupName = values.t1;
                var exampleAccountName = values.t2;
                return String.format("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.DocumentDB/databaseAccounts/%s/dbs/sales", current.apply(getClientConfigResult -> getClientConfigResult.subscriptionId()),exampleResourceGroupName,exampleAccountName);
            }))
            .permissions(SqlRoleDefinitionPermissionArgs.builder()
                .dataActions("Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read")
                .build())
            .build());

    }
}

import pulumi
import pulumi_azure as azure

current = azure.core.get_client_config()
example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="West Europe")
example_account = azure.cosmosdb.Account("exampleAccount",
    location=example_resource_group.location,
    resource_group_name=example_resource_group.name,
    offer_type="Standard",
    kind="GlobalDocumentDB",
    consistency_policy=azure.cosmosdb.AccountConsistencyPolicyArgs(
        consistency_level="Strong",
    ),
    geo_locations=[azure.cosmosdb.AccountGeoLocationArgs(
        location=example_resource_group.location,
        failover_priority=0,
    )])
example_sql_role_definition = azure.cosmosdb.SqlRoleDefinition("exampleSqlRoleDefinition",
    role_definition_id="84cf3a8b-4122-4448-bce2-fa423cfe0a15",
    resource_group_name=example_resource_group.name,
    account_name=example_account.name,
    assignable_scopes=[pulumi.Output.all(example_resource_group.name, example_account.name).apply(lambda exampleResourceGroupName, exampleAccountName: f"/subscriptions/{current.subscription_id}/resourceGroups/{example_resource_group_name}/providers/Microsoft.DocumentDB/databaseAccounts/{example_account_name}/dbs/sales")],
    permissions=[azure.cosmosdb.SqlRoleDefinitionPermissionArgs(
        data_actions=["Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read"],
    )])

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const current = azure.core.getClientConfig({});
const exampleResourceGroup = new azure.core.ResourceGroup("exampleResourceGroup", {location: "West Europe"});
const exampleAccount = new azure.cosmosdb.Account("exampleAccount", {
    location: exampleResourceGroup.location,
    resourceGroupName: exampleResourceGroup.name,
    offerType: "Standard",
    kind: "GlobalDocumentDB",
    consistencyPolicy: {
        consistencyLevel: "Strong",
    },
    geoLocations: [{
        location: exampleResourceGroup.location,
        failoverPriority: 0,
    }],
});
const exampleSqlRoleDefinition = new azure.cosmosdb.SqlRoleDefinition("exampleSqlRoleDefinition", {
    roleDefinitionId: "84cf3a8b-4122-4448-bce2-fa423cfe0a15",
    resourceGroupName: exampleResourceGroup.name,
    accountName: exampleAccount.name,
    assignableScopes: [pulumi.all([current, exampleResourceGroup.name, exampleAccount.name]).apply(([current, exampleResourceGroupName, exampleAccountName]) => `/subscriptions/${current.subscriptionId}/resourceGroups/${exampleResourceGroupName}/providers/Microsoft.DocumentDB/databaseAccounts/${exampleAccountName}/dbs/sales`)],
    permissions: [{
        dataActions: ["Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read"],
    }],
});

resources:
  exampleResourceGroup:
    type: azure:core:ResourceGroup
    properties:
      location: West Europe
  exampleAccount:
    type: azure:cosmosdb:Account
    properties:
      location: ${exampleResourceGroup.location}
      resourceGroupName: ${exampleResourceGroup.name}
      offerType: Standard
      kind: GlobalDocumentDB
      consistencyPolicy:
        consistencyLevel: Strong
      geoLocations:
        - location: ${exampleResourceGroup.location}
          failoverPriority: 0
  exampleSqlRoleDefinition:
    type: azure:cosmosdb:SqlRoleDefinition
    properties:
      roleDefinitionId: 84cf3a8b-4122-4448-bce2-fa423cfe0a15
      resourceGroupName: ${exampleResourceGroup.name}
      accountName: ${exampleAccount.name}
      assignableScopes:
        - /subscriptions/${current.subscriptionId}/resourceGroups/${exampleResourceGroup.name}/providers/Microsoft.DocumentDB/databaseAccounts/${exampleAccount.name}/dbs/sales
      permissions:
        - dataActions:
            - Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read
variables:
  current:
    Fn::Invoke:
      Function: azure:core:getClientConfig
      Arguments: {}