Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Classic
  3. API Docs
  4. pim
  5. EligibleRoleAssignment

We recommend using Azure Native.

Azure v6.22.1 published on Monday, May 12, 2025 by Pulumi
pulumi/pulumi-azure

azure.pim.EligibleRoleAssignment

Explore with Pulumi AI

azure logo

We recommend using Azure Native.

Azure v6.22.1 published on Monday, May 12, 2025 by Pulumi
pulumi/pulumi-azure

    Manages a PIM Eligible Role Assignment.

    Example Usage

    Subscription)

    import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
import * as time from "@pulumiverse/time";

const primary = azure.core.getSubscription({});
const example = azure.core.getClientConfig({});
const exampleGetRoleDefinition = azure.authorization.getRoleDefinition({
    name: "Reader",
});
const exampleStatic = new time.Static("example", {});
const exampleEligibleRoleAssignment = new azure.pim.EligibleRoleAssignment("example", {
    scope: primary.then(primary => primary.id),
    roleDefinitionId: Promise.all([primary, exampleGetRoleDefinition]).then(([primary, exampleGetRoleDefinition]) => `${primary.id}${exampleGetRoleDefinition.id}`),
    principalId: example.then(example => example.objectId),
    schedule: {
        startDateTime: exampleStatic.rfc3339,
        expiration: {
            durationHours: 8,
        },
    },
    justification: "Expiration Duration Set",
    ticket: {
        number: "1",
        system: "example ticket system",
    },
});

    import pulumi
import pulumi_azure as azure
import pulumiverse_time as time

primary = azure.core.get_subscription()
example = azure.core.get_client_config()
example_get_role_definition = azure.authorization.get_role_definition(name="Reader")
example_static = time.Static("example")
example_eligible_role_assignment = azure.pim.EligibleRoleAssignment("example",
    scope=primary.id,
    role_definition_id=f"{primary.id}{example_get_role_definition.id}",
    principal_id=example.object_id,
    schedule={
        "start_date_time": example_static.rfc3339,
        "expiration": {
            "duration_hours": 8,
        },
    },
    justification="Expiration Duration Set",
    ticket={
        "number": "1",
        "system": "example ticket system",
    })

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/authorization"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/pim"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-time/sdk/go/time"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		primary, err := core.LookupSubscription(ctx, &core.LookupSubscriptionArgs{}, nil)
		if err != nil {
			return err
		}
		example, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		exampleGetRoleDefinition, err := authorization.LookupRoleDefinition(ctx, &authorization.LookupRoleDefinitionArgs{
			Name: pulumi.StringRef("Reader"),
		}, nil)
		if err != nil {
			return err
		}
		exampleStatic, err := time.NewStatic(ctx, "example", nil)
		if err != nil {
			return err
		}
		_, err = pim.NewEligibleRoleAssignment(ctx, "example", &pim.EligibleRoleAssignmentArgs{
			Scope:            pulumi.String(primary.Id),
			RoleDefinitionId: pulumi.Sprintf("%v%v", primary.Id, exampleGetRoleDefinition.Id),
			PrincipalId:      pulumi.String(example.ObjectId),
			Schedule: &pim.EligibleRoleAssignmentScheduleArgs{
				StartDateTime: exampleStatic.Rfc3339,
				Expiration: &pim.EligibleRoleAssignmentScheduleExpirationArgs{
					DurationHours: pulumi.Int(8),
				},
			},
			Justification: pulumi.String("Expiration Duration Set"),
			Ticket: &pim.EligibleRoleAssignmentTicketArgs{
				Number: pulumi.String("1"),
				System: pulumi.String("example ticket system"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
using Time = Pulumiverse.Time;

return await Deployment.RunAsync(() => 
{
    var primary = Azure.Core.GetSubscription.Invoke();

    var example = Azure.Core.GetClientConfig.Invoke();

    var exampleGetRoleDefinition = Azure.Authorization.GetRoleDefinition.Invoke(new()
    {
        Name = "Reader",
    });

    var exampleStatic = new Time.Static("example");

    var exampleEligibleRoleAssignment = new Azure.Pim.EligibleRoleAssignment("example", new()
    {
        Scope = primary.Apply(getSubscriptionResult => getSubscriptionResult.Id),
        RoleDefinitionId = Output.Tuple(primary, exampleGetRoleDefinition).Apply(values =>
        {
            var primary = values.Item1;
            var exampleGetRoleDefinition = values.Item2;
            return $"{primary.Apply(getSubscriptionResult => getSubscriptionResult.Id)}{exampleGetRoleDefinition.Apply(getRoleDefinitionResult => getRoleDefinitionResult.Id)}";
        }),
        PrincipalId = example.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
        Schedule = new Azure.Pim.Inputs.EligibleRoleAssignmentScheduleArgs
        {
            StartDateTime = exampleStatic.Rfc3339,
            Expiration = new Azure.Pim.Inputs.EligibleRoleAssignmentScheduleExpirationArgs
            {
                DurationHours = 8,
            },
        },
        Justification = "Expiration Duration Set",
        Ticket = new Azure.Pim.Inputs.EligibleRoleAssignmentTicketArgs
        {
            Number = "1",
            System = "example ticket system",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.inputs.GetSubscriptionArgs;
import com.pulumi.azure.authorization.AuthorizationFunctions;
import com.pulumi.azure.authorization.inputs.GetRoleDefinitionArgs;
import com.pulumiverse.time.Static;
import com.pulumi.azure.pim.EligibleRoleAssignment;
import com.pulumi.azure.pim.EligibleRoleAssignmentArgs;
import com.pulumi.azure.pim.inputs.EligibleRoleAssignmentScheduleArgs;
import com.pulumi.azure.pim.inputs.EligibleRoleAssignmentScheduleExpirationArgs;
import com.pulumi.azure.pim.inputs.EligibleRoleAssignmentTicketArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var primary = CoreFunctions.getSubscription(GetSubscriptionArgs.builder()
            .build());

        final var example = CoreFunctions.getClientConfig(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference);

        final var exampleGetRoleDefinition = AuthorizationFunctions.getRoleDefinition(GetRoleDefinitionArgs.builder()
            .name("Reader")
            .build());

        var exampleStatic = new Static("exampleStatic");

        var exampleEligibleRoleAssignment = new EligibleRoleAssignment("exampleEligibleRoleAssignment", EligibleRoleAssignmentArgs.builder()
            .scope(primary.id())
            .roleDefinitionId(String.format("%s%s", primary.id(),exampleGetRoleDefinition.id()))
            .principalId(example.objectId())
            .schedule(EligibleRoleAssignmentScheduleArgs.builder()
                .startDateTime(exampleStatic.rfc3339())
                .expiration(EligibleRoleAssignmentScheduleExpirationArgs.builder()
                    .durationHours(8)
                    .build())
                .build())
            .justification("Expiration Duration Set")
            .ticket(EligibleRoleAssignmentTicketArgs.builder()
                .number("1")
                .system("example ticket system")
                .build())
            .build());

    }
}

    resources:
  exampleStatic:
    type: time:Static
    name: example
  exampleEligibleRoleAssignment:
    type: azure:pim:EligibleRoleAssignment
    name: example
    properties:
      scope: ${primary.id}
      roleDefinitionId: ${primary.id}${exampleGetRoleDefinition.id}
      principalId: ${example.objectId}
      schedule:
        startDateTime: ${exampleStatic.rfc3339}
        expiration:
          durationHours: 8
      justification: Expiration Duration Set
      ticket:
        number: '1'
        system: example ticket system
variables:
  primary:
    fn::invoke:
      function: azure:core:getSubscription
      arguments: {}
  example:
    fn::invoke:
      function: azure:core:getClientConfig
      arguments: {}
  exampleGetRoleDefinition:
    fn::invoke:
      function: azure:authorization:getRoleDefinition
      arguments:
        name: Reader

    Management Group)

    import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
import * as time from "@pulumiverse/time";

const example = azure.core.getClientConfig({});
const exampleGetRoleDefinition = azure.authorization.getRoleDefinition({
    name: "Reader",
});
const exampleGroup = new azure.management.Group("example", {name: "Example-Management-Group"});
const exampleStatic = new time.Static("example", {});
const exampleEligibleRoleAssignment = new azure.pim.EligibleRoleAssignment("example", {
    scope: exampleGroup.id,
    roleDefinitionId: exampleGetRoleDefinition.then(exampleGetRoleDefinition => exampleGetRoleDefinition.id),
    principalId: example.then(example => example.objectId),
    schedule: {
        startDateTime: exampleStatic.rfc3339,
        expiration: {
            durationHours: 8,
        },
    },
    justification: "Expiration Duration Set",
    ticket: {
        number: "1",
        system: "example ticket system",
    },
});

    import pulumi
import pulumi_azure as azure
import pulumiverse_time as time

example = azure.core.get_client_config()
example_get_role_definition = azure.authorization.get_role_definition(name="Reader")
example_group = azure.management.Group("example", name="Example-Management-Group")
example_static = time.Static("example")
example_eligible_role_assignment = azure.pim.EligibleRoleAssignment("example",
    scope=example_group.id,
    role_definition_id=example_get_role_definition.id,
    principal_id=example.object_id,
    schedule={
        "start_date_time": example_static.rfc3339,
        "expiration": {
            "duration_hours": 8,
        },
    },
    justification="Expiration Duration Set",
    ticket={
        "number": "1",
        "system": "example ticket system",
    })

    package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/authorization"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/management"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/pim"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-time/sdk/go/time"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
		if err != nil {
			return err
		}
		exampleGetRoleDefinition, err := authorization.LookupRoleDefinition(ctx, &authorization.LookupRoleDefinitionArgs{
			Name: pulumi.StringRef("Reader"),
		}, nil)
		if err != nil {
			return err
		}
		exampleGroup, err := management.NewGroup(ctx, "example", &management.GroupArgs{
			Name: pulumi.String("Example-Management-Group"),
		})
		if err != nil {
			return err
		}
		exampleStatic, err := time.NewStatic(ctx, "example", nil)
		if err != nil {
			return err
		}
		_, err = pim.NewEligibleRoleAssignment(ctx, "example", &pim.EligibleRoleAssignmentArgs{
			Scope:            exampleGroup.ID(),
			RoleDefinitionId: pulumi.String(exampleGetRoleDefinition.Id),
			PrincipalId:      pulumi.String(example.ObjectId),
			Schedule: &pim.EligibleRoleAssignmentScheduleArgs{
				StartDateTime: exampleStatic.Rfc3339,
				Expiration: &pim.EligibleRoleAssignmentScheduleExpirationArgs{
					DurationHours: pulumi.Int(8),
				},
			},
			Justification: pulumi.String("Expiration Duration Set"),
			Ticket: &pim.EligibleRoleAssignmentTicketArgs{
				Number: pulumi.String("1"),
				System: pulumi.String("example ticket system"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
using Time = Pulumiverse.Time;

return await Deployment.RunAsync(() => 
{
    var example = Azure.Core.GetClientConfig.Invoke();

    var exampleGetRoleDefinition = Azure.Authorization.GetRoleDefinition.Invoke(new()
    {
        Name = "Reader",
    });

    var exampleGroup = new Azure.Management.Group("example", new()
    {
        Name = "Example-Management-Group",
    });

    var exampleStatic = new Time.Static("example");

    var exampleEligibleRoleAssignment = new Azure.Pim.EligibleRoleAssignment("example", new()
    {
        Scope = exampleGroup.Id,
        RoleDefinitionId = exampleGetRoleDefinition.Apply(getRoleDefinitionResult => getRoleDefinitionResult.Id),
        PrincipalId = example.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
        Schedule = new Azure.Pim.Inputs.EligibleRoleAssignmentScheduleArgs
        {
            StartDateTime = exampleStatic.Rfc3339,
            Expiration = new Azure.Pim.Inputs.EligibleRoleAssignmentScheduleExpirationArgs
            {
                DurationHours = 8,
            },
        },
        Justification = "Expiration Duration Set",
        Ticket = new Azure.Pim.Inputs.EligibleRoleAssignmentTicketArgs
        {
            Number = "1",
            System = "example ticket system",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.authorization.AuthorizationFunctions;
import com.pulumi.azure.authorization.inputs.GetRoleDefinitionArgs;
import com.pulumi.azure.management.Group;
import com.pulumi.azure.management.GroupArgs;
import com.pulumiverse.time.Static;
import com.pulumi.azure.pim.EligibleRoleAssignment;
import com.pulumi.azure.pim.EligibleRoleAssignmentArgs;
import com.pulumi.azure.pim.inputs.EligibleRoleAssignmentScheduleArgs;
import com.pulumi.azure.pim.inputs.EligibleRoleAssignmentScheduleExpirationArgs;
import com.pulumi.azure.pim.inputs.EligibleRoleAssignmentTicketArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var example = CoreFunctions.getClientConfig(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference);

        final var exampleGetRoleDefinition = AuthorizationFunctions.getRoleDefinition(GetRoleDefinitionArgs.builder()
            .name("Reader")
            .build());

        var exampleGroup = new Group("exampleGroup", GroupArgs.builder()
            .name("Example-Management-Group")
            .build());

        var exampleStatic = new Static("exampleStatic");

        var exampleEligibleRoleAssignment = new EligibleRoleAssignment("exampleEligibleRoleAssignment", EligibleRoleAssignmentArgs.builder()
            .scope(exampleGroup.id())
            .roleDefinitionId(exampleGetRoleDefinition.id())
            .principalId(example.objectId())
            .schedule(EligibleRoleAssignmentScheduleArgs.builder()
                .startDateTime(exampleStatic.rfc3339())
                .expiration(EligibleRoleAssignmentScheduleExpirationArgs.builder()
                    .durationHours(8)
                    .build())
                .build())
            .justification("Expiration Duration Set")
            .ticket(EligibleRoleAssignmentTicketArgs.builder()
                .number("1")
                .system("example ticket system")
                .build())
            .build());

    }
}

    resources:
  exampleGroup:
    type: azure:management:Group
    name: example
    properties:
      name: Example-Management-Group
  exampleStatic:
    type: time:Static
    name: example
  exampleEligibleRoleAssignment:
    type: azure:pim:EligibleRoleAssignment
    name: example
    properties:
      scope: ${exampleGroup.id}
      roleDefinitionId: ${exampleGetRoleDefinition.id}
      principalId: ${example.objectId}
      schedule:
        startDateTime: ${exampleStatic.rfc3339}
        expiration:
          durationHours: 8
      justification: Expiration Duration Set
      ticket:
        number: '1'
        system: example ticket system
variables:
  example:
    fn::invoke:
      function: azure:core:getClientConfig
      arguments: {}
  exampleGetRoleDefinition:
    fn::invoke:
      function: azure:authorization:getRoleDefinition
      arguments:
        name: Reader

    Create EligibleRoleAssignment Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new EligibleRoleAssignment(name: string, args: EligibleRoleAssignmentArgs, opts?: CustomResourceOptions);
    @overload
def EligibleRoleAssignment(resource_name: str,
                           args: EligibleRoleAssignmentArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def EligibleRoleAssignment(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           principal_id: Optional[str] = None,
                           role_definition_id: Optional[str] = None,
                           scope: Optional[str] = None,
                           condition: Optional[str] = None,
                           condition_version: Optional[str] = None,
                           justification: Optional[str] = None,
                           schedule: Optional[EligibleRoleAssignmentScheduleArgs] = None,
                           ticket: Optional[EligibleRoleAssignmentTicketArgs] = None)
    func NewEligibleRoleAssignment(ctx *Context, name string, args EligibleRoleAssignmentArgs, opts ...ResourceOption) (*EligibleRoleAssignment, error)
    public EligibleRoleAssignment(string name, EligibleRoleAssignmentArgs args, CustomResourceOptions? opts = null)
    public EligibleRoleAssignment(String name, EligibleRoleAssignmentArgs args)
public EligibleRoleAssignment(String name, EligibleRoleAssignmentArgs args, CustomResourceOptions options)

    type: azure:pim:EligibleRoleAssignment
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args EligibleRoleAssignmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args EligibleRoleAssignmentArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args EligibleRoleAssignmentArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args EligibleRoleAssignmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args EligibleRoleAssignmentArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var eligibleRoleAssignmentResource = new Azure.Pim.EligibleRoleAssignment("eligibleRoleAssignmentResource", new()
{
    PrincipalId = "string",
    RoleDefinitionId = "string",
    Scope = "string",
    Condition = "string",
    ConditionVersion = "string",
    Justification = "string",
    Schedule = new Azure.Pim.Inputs.EligibleRoleAssignmentScheduleArgs
    {
        Expiration = new Azure.Pim.Inputs.EligibleRoleAssignmentScheduleExpirationArgs
        {
            DurationDays = 0,
            DurationHours = 0,
            EndDateTime = "string",
        },
        StartDateTime = "string",
    },
    Ticket = new Azure.Pim.Inputs.EligibleRoleAssignmentTicketArgs
    {
        Number = "string",
        System = "string",
    },
});

    example, err := pim.NewEligibleRoleAssignment(ctx, "eligibleRoleAssignmentResource", &pim.EligibleRoleAssignmentArgs{
	PrincipalId:      pulumi.String("string"),
	RoleDefinitionId: pulumi.String("string"),
	Scope:            pulumi.String("string"),
	Condition:        pulumi.String("string"),
	ConditionVersion: pulumi.String("string"),
	Justification:    pulumi.String("string"),
	Schedule: &pim.EligibleRoleAssignmentScheduleArgs{
		Expiration: &pim.EligibleRoleAssignmentScheduleExpirationArgs{
			DurationDays:  pulumi.Int(0),
			DurationHours: pulumi.Int(0),
			EndDateTime:   pulumi.String("string"),
		},
		StartDateTime: pulumi.String("string"),
	},
	Ticket: &pim.EligibleRoleAssignmentTicketArgs{
		Number: pulumi.String("string"),
		System: pulumi.String("string"),
	},
})

    var eligibleRoleAssignmentResource = new EligibleRoleAssignment("eligibleRoleAssignmentResource", EligibleRoleAssignmentArgs.builder()
    .principalId("string")
    .roleDefinitionId("string")
    .scope("string")
    .condition("string")
    .conditionVersion("string")
    .justification("string")
    .schedule(EligibleRoleAssignmentScheduleArgs.builder()
        .expiration(EligibleRoleAssignmentScheduleExpirationArgs.builder()
            .durationDays(0)
            .durationHours(0)
            .endDateTime("string")
            .build())
        .startDateTime("string")
        .build())
    .ticket(EligibleRoleAssignmentTicketArgs.builder()
        .number("string")
        .system("string")
        .build())
    .build());

    eligible_role_assignment_resource = azure.pim.EligibleRoleAssignment("eligibleRoleAssignmentResource",
    principal_id="string",
    role_definition_id="string",
    scope="string",
    condition="string",
    condition_version="string",
    justification="string",
    schedule={
        "expiration": {
            "duration_days": 0,
            "duration_hours": 0,
            "end_date_time": "string",
        },
        "start_date_time": "string",
    },
    ticket={
        "number": "string",
        "system": "string",
    })

    const eligibleRoleAssignmentResource = new azure.pim.EligibleRoleAssignment("eligibleRoleAssignmentResource", {
    principalId: "string",
    roleDefinitionId: "string",
    scope: "string",
    condition: "string",
    conditionVersion: "string",
    justification: "string",
    schedule: {
        expiration: {
            durationDays: 0,
            durationHours: 0,
            endDateTime: "string",
        },
        startDateTime: "string",
    },
    ticket: {
        number: "string",
        system: "string",
    },
});

    type: azure:pim:EligibleRoleAssignment
properties:
    condition: string
    conditionVersion: string
    justification: string
    principalId: string
    roleDefinitionId: string
    schedule:
        expiration:
            durationDays: 0
            durationHours: 0
            endDateTime: string
        startDateTime: string
    scope: string
    ticket:
        number: string
        system: string

    EligibleRoleAssignment Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The EligibleRoleAssignment resource accepts the following input properties:

    PrincipalId string
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    RoleDefinitionId string
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    Scope string
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    Condition string
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    ConditionVersion string

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    Justification string
    The justification of the role assignment. Changing this forces a new resource to be created.
    Schedule EligibleRoleAssignmentSchedule
    A schedule block as defined below. Changing this forces a new resource to be created.
    Ticket EligibleRoleAssignmentTicket
    A ticket block as defined below. Changing this forces a new resource to be created.
    PrincipalId string
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    RoleDefinitionId string
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    Scope string
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    Condition string
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    ConditionVersion string

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    Justification string
    The justification of the role assignment. Changing this forces a new resource to be created.
    Schedule EligibleRoleAssignmentScheduleArgs
    A schedule block as defined below. Changing this forces a new resource to be created.
    Ticket EligibleRoleAssignmentTicketArgs
    A ticket block as defined below. Changing this forces a new resource to be created.
    principalId String
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    roleDefinitionId String
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    scope String
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    condition String
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    conditionVersion String

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification String
    The justification of the role assignment. Changing this forces a new resource to be created.
    schedule EligibleRoleAssignmentSchedule
    A schedule block as defined below. Changing this forces a new resource to be created.
    ticket EligibleRoleAssignmentTicket
    A ticket block as defined below. Changing this forces a new resource to be created.
    principalId string
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    roleDefinitionId string
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    scope string
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    condition string
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    conditionVersion string

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification string
    The justification of the role assignment. Changing this forces a new resource to be created.
    schedule EligibleRoleAssignmentSchedule
    A schedule block as defined below. Changing this forces a new resource to be created.
    ticket EligibleRoleAssignmentTicket
    A ticket block as defined below. Changing this forces a new resource to be created.
    principal_id str
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    role_definition_id str
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    scope str
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    condition str
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    condition_version str

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification str
    The justification of the role assignment. Changing this forces a new resource to be created.
    schedule EligibleRoleAssignmentScheduleArgs
    A schedule block as defined below. Changing this forces a new resource to be created.
    ticket EligibleRoleAssignmentTicketArgs
    A ticket block as defined below. Changing this forces a new resource to be created.
    principalId String
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    roleDefinitionId String
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    scope String
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    condition String
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    conditionVersion String

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification String
    The justification of the role assignment. Changing this forces a new resource to be created.
    schedule Property Map
    A schedule block as defined below. Changing this forces a new resource to be created.
    ticket Property Map
    A ticket block as defined below. Changing this forces a new resource to be created.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the EligibleRoleAssignment resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    PrincipalType string
    Type of principal to which the role will be assigned.
    Id string
    The provider-assigned unique ID for this managed resource.
    PrincipalType string
    Type of principal to which the role will be assigned.
    id String
    The provider-assigned unique ID for this managed resource.
    principalType String
    Type of principal to which the role will be assigned.
    id string
    The provider-assigned unique ID for this managed resource.
    principalType string
    Type of principal to which the role will be assigned.
    id str
    The provider-assigned unique ID for this managed resource.
    principal_type str
    Type of principal to which the role will be assigned.
    id String
    The provider-assigned unique ID for this managed resource.
    principalType String
    Type of principal to which the role will be assigned.

    Look up Existing EligibleRoleAssignment Resource

    Get an existing EligibleRoleAssignment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: EligibleRoleAssignmentState, opts?: CustomResourceOptions): EligibleRoleAssignment
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        condition: Optional[str] = None,
        condition_version: Optional[str] = None,
        justification: Optional[str] = None,
        principal_id: Optional[str] = None,
        principal_type: Optional[str] = None,
        role_definition_id: Optional[str] = None,
        schedule: Optional[EligibleRoleAssignmentScheduleArgs] = None,
        scope: Optional[str] = None,
        ticket: Optional[EligibleRoleAssignmentTicketArgs] = None) -> EligibleRoleAssignment
    func GetEligibleRoleAssignment(ctx *Context, name string, id IDInput, state *EligibleRoleAssignmentState, opts ...ResourceOption) (*EligibleRoleAssignment, error)
    public static EligibleRoleAssignment Get(string name, Input<string> id, EligibleRoleAssignmentState? state, CustomResourceOptions? opts = null)
    public static EligibleRoleAssignment get(String name, Output<String> id, EligibleRoleAssignmentState state, CustomResourceOptions options)
    resources:  _:    type: azure:pim:EligibleRoleAssignment    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Condition string
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    ConditionVersion string

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    Justification string
    The justification of the role assignment. Changing this forces a new resource to be created.
    PrincipalId string
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    PrincipalType string
    Type of principal to which the role will be assigned.
    RoleDefinitionId string
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    Schedule EligibleRoleAssignmentSchedule
    A schedule block as defined below. Changing this forces a new resource to be created.
    Scope string
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    Ticket EligibleRoleAssignmentTicket
    A ticket block as defined below. Changing this forces a new resource to be created.
    Condition string
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    ConditionVersion string

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    Justification string
    The justification of the role assignment. Changing this forces a new resource to be created.
    PrincipalId string
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    PrincipalType string
    Type of principal to which the role will be assigned.
    RoleDefinitionId string
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    Schedule EligibleRoleAssignmentScheduleArgs
    A schedule block as defined below. Changing this forces a new resource to be created.
    Scope string
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    Ticket EligibleRoleAssignmentTicketArgs
    A ticket block as defined below. Changing this forces a new resource to be created.
    condition String
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    conditionVersion String

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification String
    The justification of the role assignment. Changing this forces a new resource to be created.
    principalId String
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    principalType String
    Type of principal to which the role will be assigned.
    roleDefinitionId String
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    schedule EligibleRoleAssignmentSchedule
    A schedule block as defined below. Changing this forces a new resource to be created.
    scope String
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    ticket EligibleRoleAssignmentTicket
    A ticket block as defined below. Changing this forces a new resource to be created.
    condition string
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    conditionVersion string

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification string
    The justification of the role assignment. Changing this forces a new resource to be created.
    principalId string
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    principalType string
    Type of principal to which the role will be assigned.
    roleDefinitionId string
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    schedule EligibleRoleAssignmentSchedule
    A schedule block as defined below. Changing this forces a new resource to be created.
    scope string
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    ticket EligibleRoleAssignmentTicket
    A ticket block as defined below. Changing this forces a new resource to be created.
    condition str
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    condition_version str

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification str
    The justification of the role assignment. Changing this forces a new resource to be created.
    principal_id str
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    principal_type str
    Type of principal to which the role will be assigned.
    role_definition_id str
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    schedule EligibleRoleAssignmentScheduleArgs
    A schedule block as defined below. Changing this forces a new resource to be created.
    scope str
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    ticket EligibleRoleAssignmentTicketArgs
    A ticket block as defined below. Changing this forces a new resource to be created.
    condition String
    The condition that limits the resources that the role can be assigned to. See the official conditions documentation for details. Changing this forces a new resource to be created.
    conditionVersion String

    The version of the condition. Supported values include 2.0. Changing this forces a new resource to be created.

    NOTE: condition_version is required when specifying condition and vice versa.

    justification String
    The justification of the role assignment. Changing this forces a new resource to be created.
    principalId String
    Object ID of the principal for this eligible role assignment. Changing this forces a new resource to be created.
    principalType String
    Type of principal to which the role will be assigned.
    roleDefinitionId String
    The role definition ID for this eligible role assignment. Changing this forces a new resource to be created.
    schedule Property Map
    A schedule block as defined below. Changing this forces a new resource to be created.
    scope String
    The scope for this eligible role assignment, should be a valid resource ID. Changing this forces a new resource to be created.
    ticket Property Map
    A ticket block as defined below. Changing this forces a new resource to be created.

    Supporting Types

    EligibleRoleAssignmentSchedule, EligibleRoleAssignmentScheduleArgs

    Expiration EligibleRoleAssignmentScheduleExpiration
    An expiration block as defined above.
    StartDateTime string
    The start date/time of the role assignment. Changing this forces a new resource to be created.
    Expiration EligibleRoleAssignmentScheduleExpiration
    An expiration block as defined above.
    StartDateTime string
    The start date/time of the role assignment. Changing this forces a new resource to be created.
    expiration EligibleRoleAssignmentScheduleExpiration
    An expiration block as defined above.
    startDateTime String
    The start date/time of the role assignment. Changing this forces a new resource to be created.
    expiration EligibleRoleAssignmentScheduleExpiration
    An expiration block as defined above.
    startDateTime string
    The start date/time of the role assignment. Changing this forces a new resource to be created.
    expiration EligibleRoleAssignmentScheduleExpiration
    An expiration block as defined above.
    start_date_time str
    The start date/time of the role assignment. Changing this forces a new resource to be created.
    expiration Property Map
    An expiration block as defined above.
    startDateTime String
    The start date/time of the role assignment. Changing this forces a new resource to be created.

    EligibleRoleAssignmentScheduleExpiration, EligibleRoleAssignmentScheduleExpirationArgs

    DurationDays int
    The duration of the role assignment in days. Changing this forces a new resource to be created.
    DurationHours int
    The duration of the role assignment in hours. Changing this forces a new resource to be created.
    EndDateTime string

    The end date/time of the role assignment. Changing this forces a new resource to be created.

    Note: Only one of duration_days, duration_hours or end_date_time should be specified.

    DurationDays int
    The duration of the role assignment in days. Changing this forces a new resource to be created.
    DurationHours int
    The duration of the role assignment in hours. Changing this forces a new resource to be created.
    EndDateTime string

    The end date/time of the role assignment. Changing this forces a new resource to be created.

    Note: Only one of duration_days, duration_hours or end_date_time should be specified.

    durationDays Integer
    The duration of the role assignment in days. Changing this forces a new resource to be created.
    durationHours Integer
    The duration of the role assignment in hours. Changing this forces a new resource to be created.
    endDateTime String

    The end date/time of the role assignment. Changing this forces a new resource to be created.

    Note: Only one of duration_days, duration_hours or end_date_time should be specified.

    durationDays number
    The duration of the role assignment in days. Changing this forces a new resource to be created.
    durationHours number
    The duration of the role assignment in hours. Changing this forces a new resource to be created.
    endDateTime string

    The end date/time of the role assignment. Changing this forces a new resource to be created.

    Note: Only one of duration_days, duration_hours or end_date_time should be specified.

    duration_days int
    The duration of the role assignment in days. Changing this forces a new resource to be created.
    duration_hours int
    The duration of the role assignment in hours. Changing this forces a new resource to be created.
    end_date_time str

    The end date/time of the role assignment. Changing this forces a new resource to be created.

    Note: Only one of duration_days, duration_hours or end_date_time should be specified.

    durationDays Number
    The duration of the role assignment in days. Changing this forces a new resource to be created.
    durationHours Number
    The duration of the role assignment in hours. Changing this forces a new resource to be created.
    endDateTime String

    The end date/time of the role assignment. Changing this forces a new resource to be created.

    Note: Only one of duration_days, duration_hours or end_date_time should be specified.

    EligibleRoleAssignmentTicket, EligibleRoleAssignmentTicketArgs

    Number string
    User-supplied ticket number to be included with the request. Changing this forces a new resource to be created.
    System string
    User-supplied ticket system name to be included with the request. Changing this forces a new resource to be created.
    Number string
    User-supplied ticket number to be included with the request. Changing this forces a new resource to be created.
    System string
    User-supplied ticket system name to be included with the request. Changing this forces a new resource to be created.
    number String
    User-supplied ticket number to be included with the request. Changing this forces a new resource to be created.
    system String
    User-supplied ticket system name to be included with the request. Changing this forces a new resource to be created.
    number string
    User-supplied ticket number to be included with the request. Changing this forces a new resource to be created.
    system string
    User-supplied ticket system name to be included with the request. Changing this forces a new resource to be created.
    number str
    User-supplied ticket number to be included with the request. Changing this forces a new resource to be created.
    system str
    User-supplied ticket system name to be included with the request. Changing this forces a new resource to be created.
    number String
    User-supplied ticket number to be included with the request. Changing this forces a new resource to be created.
    system String
    User-supplied ticket system name to be included with the request. Changing this forces a new resource to be created.

    Import

    PIM Eligible Role Assignments can be imported using the following composite resource ID, e.g.

    $ pulumi import azure:pim/eligibleRoleAssignment:EligibleRoleAssignment example /subscriptions/00000000-0000-0000-0000-000000000000|/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/00000000-0000-0000-0000-000000000000|00000000-0000-0000-0000-000000000000

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure Classic pulumi/pulumi-azure
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azurerm Terraform Provider.
    azure logo

    We recommend using Azure Native.

    Azure v6.22.1 published on Monday, May 12, 2025 by Pulumi
    pulumi/pulumi-azure