// Group-based RBAC at subscription scope: the pattern BAS-003 recommends. Individuals get access by
// joining the group (through PIM), never by direct assignment.

targetScope = 'subscription'

@description('Object ID of the Entra ID group.')
param groupObjectId string

@description('Role definition GUID, e.g. b24988ac-6180-42a0-ab88-20f7382dd24c for Contributor.')
param roleDefinitionGuid string

resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(subscription().id, groupObjectId, roleDefinitionGuid)
  properties: {
    principalId: groupObjectId
    principalType: 'Group'
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionGuid)
  }
}

output assignmentId string = assignment.id