@microsoft/terraform-cdk-constructs 1.6.0 → 1.7.1

package/.jsii

@@ -211,7 +211,7 @@
         "line": 46
       },
       "readme": {
-        "markdown": "# Azure Policy Assignment Construct\n\nThis module provides a unified, version-aware implementation for managing Azure Policy Assignments using the AZAPI provider and CDK for Terraform.\n\n## Overview\n\nAzure Policy Assignments apply policy definitions to specific scopes (subscription, resource group, or resource) and provide parameter values for policy enforcement. Policy assignments can configure enforcement modes, managed identities for remediation, and custom non-compliance messages.\n\n## Key Features\n\n- **AZAPI Provider Integration**: Direct ARM API access for reliable deployments\n- **Version-Aware**: Automatically uses the latest stable API version (2022-06-01)\n- **Schema-Driven Validation**: Built-in validation based on Azure API schemas\n- **Type-Safe**: Full TypeScript support with comprehensive interfaces\n- **JSII Compatible**: Can be used from multiple programming languages\n- **Flexible Scoping**: Support for subscription, resource group, and resource-level assignments\n- **Enforcement Modes**: Control whether policies are enforced or audited\n- **Managed Identity Support**: Enable remediation for deployIfNotExists and modify policies\n- **Scope Exclusions**: Exclude specific scopes from policy evaluation\n\n## AZAPI Provider Benefits\n\nThis construct uses the AZAPI provider, which offers several advantages:\n\n1. **Direct ARM API Access**: Communicates directly with Azure Resource Manager APIs\n2. **Faster Updates**: New Azure features are available immediately without provider updates\n3. **Consistent Behavior**: Matches Azure's native behavior exactly\n4. **Better Error Messages**: Detailed error messages directly from Azure\n5. **Version Flexibility**: Easily pin to specific API versions for stability\n\n## Installation\n\nThis package is part of the `@microsoft/terraform-cdk-constructs` library.\n\n```bash\nnpm install @microsoft/terraform-cdk-constructs\n```\n\n## Basic Usage\n\n### Simple Policy Assignment\n\n```typescript\nimport { App, TerraformStack } from \"cdktf\";\nimport { AzapiProvider } from \"@microsoft/terraform-cdk-constructs/core-azure\";\nimport { PolicyDefinition } from \"@microsoft/terraform-cdk-constructs/azure-policydefinition\";\nimport { PolicyAssignment } from \"@microsoft/terraform-cdk-constructs/azure-policyassignment\";\n\nclass MyStack extends TerraformStack {\n  constructor(scope: App, name: string) {\n    super(scope, name);\n\n    // Configure the AZAPI provider\n    new AzapiProvider(this, \"azapi\", {});\n\n    // First create or reference a policy definition\n    const policyDef = new PolicyDefinition(this, \"require-tags\", {\n      name: \"require-environment-tag\",\n      policyRule: {\n        if: {\n          field: \"tags['Environment']\",\n          exists: \"false\",\n        },\n        then: {\n          effect: \"deny\",\n        },\n      },\n    });\n\n    // Then assign the policy to a scope\n    const assignment = new PolicyAssignment(this, \"tag-assignment\", {\n      name: \"require-tags-on-rg\",\n      displayName: \"Require Environment Tag on Resources\",\n      description: \"Ensures all resources in this resource group have an Environment tag\",\n      policyDefinitionId: policyDef.id,\n      scope: \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg\",\n    });\n\n    console.log(\"Assignment ID:\", assignment.id);\n  }\n}\n\nconst app = new App();\nnew MyStack(app, \"my-stack\");\napp.synth();\n```\n\n### Assignment with Parameters\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"tag-assignment\", {\n  name: \"require-environment-tag\",\n  displayName: \"Require Environment Tag\",\n  policyDefinitionId: parameterizedPolicyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  parameters: {\n    tagName: {\n      value: \"Environment\",\n    },\n    allowedValues: {\n      value: [\"Development\", \"Staging\", \"Production\"],\n    },\n    effect: {\n      value: \"deny\",\n    },\n  },\n});\n```\n\n### Assignment with Built-in Policy\n\n```typescript\n// Reference a built-in Azure policy\nconst assignment = new PolicyAssignment(this, \"builtin-assignment\", {\n  name: \"audit-vm-managed-disks\",\n  displayName: \"Audit VMs without Managed Disks\",\n  policyDefinitionId:\n    \"/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d\",\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  enforcementMode: \"Default\",\n});\n```\n\n## Advanced Features\n\n### Enforcement Modes\n\nControl whether the policy is enforced or only audited:\n\n```typescript\n// Audit mode - policy is evaluated but not enforced\nconst auditAssignment = new PolicyAssignment(this, \"audit-assignment\", {\n  name: \"audit-policy\",\n  displayName: \"Audit Policy (DoNotEnforce)\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  enforcementMode: \"DoNotEnforce\", // Audit only\n});\n\n// Enforcement mode - policy is actively enforced (default)\nconst enforceAssignment = new PolicyAssignment(this, \"enforce-assignment\", {\n  name: \"enforce-policy\",\n  displayName: \"Enforce Policy (Default)\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  enforcementMode: \"Default\", // Actively enforced\n});\n```\n\n### Managed Identity for Remediation\n\nFor policies with deployIfNotExists or modify effects, add a managed identity:\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"remediation-assignment\", {\n  name: \"deploy-vm-monitoring\",\n  displayName: \"Deploy VM Monitoring Extension\",\n  policyDefinitionId: deployPolicyId,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  identity: {\n    type: \"SystemAssigned\",\n  },\n});\n\n// Or use a user-assigned identity\nconst userIdentityAssignment = new PolicyAssignment(\n  this,\n  \"user-identity-assignment\",\n  {\n    name: \"deploy-with-user-identity\",\n    policyDefinitionId: deployPolicyId,\n    scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n    identity: {\n      type: \"UserAssigned\",\n      userAssignedIdentities: {\n        \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity\":\n          {},\n      },\n    },\n  },\n);\n```\n\n### Scope Exclusions\n\nExclude specific scopes from policy evaluation:\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"with-exclusions\", {\n  name: \"subscription-policy-with-exclusions\",\n  displayName: \"Subscription Policy with Exclusions\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  notScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/excluded-rg\",\n    \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg\",\n  ],\n});\n```\n\n### Custom Non-Compliance Messages\n\nProvide helpful messages when resources are non-compliant:\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"with-messages\", {\n  name: \"tag-policy\",\n  displayName: \"Require Resource Tags\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  nonComplianceMessages: [\n    {\n      message:\n        \"All resources must have the required tags. Please add the Environment tag with an appropriate value.\",\n    },\n  ],\n});\n```\n\n### Explicit API Version\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"pinned-version\", {\n  name: \"my-assignment\",\n  apiVersion: \"2022-06-01\", // Pin to specific version for stability\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n});\n```\n\n### Using Outputs\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"assignment\", {\n  name: \"my-assignment\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n});\n\n// Use the assignment ID in other resources\nnew TerraformOutput(this, \"assignment-id\", {\n  value: assignment.id,\n});\n\n// Access assignment properties\nconsole.log(\"Policy Definition ID:\", assignment.policyDefinitionId);\nconsole.log(\"Assignment Scope:\", assignment.assignmentScope);\nconsole.log(\"Enforcement Mode:\", assignment.enforcementMode);\n```\n\n## Complete Properties Documentation\n\n### PolicyAssignmentProps\n\n| Property                 | Type     | Required | Default   | Description                                           |\n| ------------------------ | -------- | -------- | --------- | ----------------------------------------------------- |\n| `name`                   | string   | No\\*     | Construct | Name of the policy assignment                         |\n| `policyDefinitionId`     | string   | **Yes**  | -         | ID of the policy definition to assign                 |\n| `scope`                  | string   | **Yes**  | -         | Scope where the policy is assigned                    |\n| `displayName`            | string   | No       | -         | Display name for the assignment                       |\n| `description`            | string   | No       | -         | Description of the assignment                         |\n| `enforcementMode`        | string   | No       | \"Default\" | Default or DoNotEnforce                               |\n| `parameters`             | object   | No       | -         | Parameter values for the policy                       |\n| `metadata`               | object   | No       | -         | Additional metadata                                   |\n| `identity`               | object   | No       | -         | Managed identity configuration                        |\n| `notScopes`              | string[] | No       | -         | Scopes to exclude from policy evaluation              |\n| `nonComplianceMessages`  | array    | No       | -         | Custom non-compliance messages                        |\n| `apiVersion`             | string   | No       | latest    | Specific API version to use                           |\n| `ignoreChanges`          | string[] | No       | -         | Properties to ignore during Terraform updates         |\n| `enableValidation`       | boolean  | No       | true      | Enable schema validation                              |\n| `enableMigrationAnalysis`| boolean  | No       | false     | Enable migration analysis between versions            |\n| `enableTransformation`   | boolean  | No       | true      | Enable property transformation                        |\n\n\\*If `name` is not provided, the construct ID will be used as the assignment name.\n\n## Supported API Versions\n\n| Version    | Support Level | Release Date | Notes                               |\n| ---------- | ------------- | ------------ | ----------------------------------- |\n| 2022-06-01 | Active        | 2022-06-01   | Latest stable version (recommended) |\n\n## Policy Assignment Concepts\n\n### Scoping Levels\n\nPolicy assignments can be applied at different organizational levels:\n\n#### Subscription Scope\n\n```typescript\nscope: \"/subscriptions/00000000-0000-0000-0000-000000000000\";\n```\n\nApplies to all resources in the subscription (unless excluded via notScopes)\n\n#### Resource Group Scope\n\n```typescript\nscope:\n  \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg\";\n```\n\nApplies to all resources in the resource group\n\n#### Resource Scope\n\n```typescript\nscope:\n  \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorage\";\n```\n\nApplies to a specific resource\n\n### Enforcement Modes\n\n- **Default**: Policy effect is enforced during resource creation/update (deny, modify, deployIfNotExists)\n- **DoNotEnforce**: Policy is evaluated but the effect is not enforced (audit only mode)\n\nUse DoNotEnforce to test policies without impacting resources, then switch to Default when ready.\n\n### Identity Types\n\nManaged identities are required for policy assignments that use deployIfNotExists or modify effects:\n\n- **SystemAssigned**: Azure automatically creates and manages an identity for the assignment\n- **UserAssigned**: You provide an existing managed identity\n- **None**: No identity (use for audit and deny policies)\n\nThe identity needs appropriate RBAC permissions (typically Contributor or specific resource permissions) to perform remediation actions.\n\n## Available Outputs\n\nPolicy Assignment constructs expose the following outputs:\n\n- `id`: The Azure resource ID of the policy assignment\n- `name`: The name of the policy assignment\n- `resourceId`: Alias for the ID (for consistency with other constructs)\n- `policyDefinitionId`: The ID of the assigned policy definition\n- `assignmentScope`: The scope where the policy is assigned\n- `enforcementMode`: The enforcement mode of the assignment\n\n## Best Practices\n\n1. **Start with DoNotEnforce Mode**\n\n   - Test new assignments in audit mode first\n   - Monitor compliance reports before enforcing\n   - Gradually roll out enforcement after validation\n\n2. **Use Descriptive Names**\n\n   - Make assignment purpose clear from the name\n   - Include scope information in display name\n   - Document the assignment's intent\n\n3. **Provide Non-Compliance Messages**\n\n   - Help users understand why resources are non-compliant\n   - Include remediation steps in messages\n   - Be specific and actionable\n\n4. **Scope Appropriately**\n\n   - Apply policies at the right organizational level\n   - Use subscription scope for organization-wide policies\n   - Use resource group scope for environment-specific policies\n\n5. **Use Parameters Effectively**\n\n   - Reuse policy definitions with different parameter values\n   - Provide appropriate defaults in policy definitions\n   - Document parameter requirements\n\n6. **Configure Identity Correctly**\n\n   - Add managed identity for deployIfNotExists and modify policies\n   - Grant minimum required permissions (least privilege)\n   - Use user-assigned identities for shared remediation scenarios\n\n7. **Monitor and Review**\n\n   - Regularly review compliance reports\n   - Address non-compliant resources\n   - Update policies and assignments as requirements change\n\n8. **Document Exclusions**\n   - Clearly document why scopes are excluded\n   - Regularly review exclusions for continued validity\n   - Minimize the use of exclusions\n\n## Examples\n\n### Assign Tag Policy at Subscription Level\n\n```typescript\nconst tagPolicy = new PolicyDefinition(this, \"tag-policy\", {\n  name: \"require-cost-center\",\n  policyRule: {\n    if: {\n      field: \"tags['CostCenter']\",\n      exists: \"false\",\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n\nconst tagAssignment = new PolicyAssignment(this, \"sub-tag-assignment\", {\n  name: \"require-cost-center-sub\",\n  displayName: \"Require CostCenter Tag on All Resources\",\n  description: \"Denies resource creation without CostCenter tag\",\n  policyDefinitionId: tagPolicy.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  nonComplianceMessages: [\n    {\n      message:\n        \"Resources must have a CostCenter tag for billing purposes. Contact your team lead for the appropriate cost center code.\",\n    },\n  ],\n});\n```\n\n### Audit Mode Testing\n\n```typescript\n// Test a policy in audit mode before enforcing\nconst testAssignment = new PolicyAssignment(this, \"test-assignment\", {\n  name: \"test-location-policy\",\n  displayName: \"Test Location Restriction (Audit Only)\",\n  description: \"Testing location policy in audit mode\",\n  policyDefinitionId: locationPolicyId,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg\",\n  enforcementMode: \"DoNotEnforce\", // Audit only\n  metadata: {\n    testPhase: \"audit\",\n    plannedEnforcement: \"2024-02-01\",\n  },\n});\n```\n\n### Remediation with Managed Identity\n\n```typescript\nconst remediationPolicy = new PolicyDefinition(this, \"deploy-backup\", {\n  name: \"deploy-vm-backup\",\n  policyRule: {\n    if: {\n      field: \"type\",\n      equals: \"Microsoft.Compute/virtualMachines\",\n    },\n    then: {\n      effect: \"deployIfNotExists\",\n      details: {\n        type: \"Microsoft.RecoveryServices/backupprotecteditems\",\n        deploymentScope: \"subscription\",\n        // ... deployment template\n      },\n    },\n  },\n});\n\nconst remediationAssignment = new PolicyAssignment(\n  this,\n  \"backup-assignment\",\n  {\n    name: \"deploy-vm-backup-assignment\",\n    displayName: \"Deploy VM Backup Configuration\",\n    description:\n      \"Automatically deploys backup configuration for virtual machines\",\n    policyDefinitionId: remediationPolicy.id,\n    scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n    identity: {\n      type: \"SystemAssigned\",\n    },\n  },\n);\n\n// Note: You would also need to create a role assignment to grant\n// the managed identity permissions to deploy backup configurations\n```\n\n### Multiple Assignments for Different Environments\n\n```typescript\nconst environments = [\"dev\", \"staging\", \"prod\"];\n\nenvironments.forEach((env) => {\n  const rgScope = `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/${env}-rg`;\n\n  new PolicyAssignment(this, `${env}-assignment`, {\n    name: `require-tags-${env}`,\n    displayName: `Require Tags in ${env.toUpperCase()} Environment`,\n    policyDefinitionId: tagPolicyId,\n    scope: rgScope,\n    parameters: {\n      environmentTag: {\n        value: env,\n      },\n    },\n    metadata: {\n      environment: env,\n      assignedBy: \"terraform-cdk\",\n    },\n  });\n});\n```\n\n## Relationship with Policy Definitions\n\nPolicy Assignments apply Policy Definitions to specific scopes. The typical workflow is:\n\n1. **Create or Reference a Policy Definition**: Define the rules and conditions\n2. **Create a Policy Assignment**: Apply the definition to a scope with specific parameters\n3. **Monitor Compliance**: Review compliance reports and take remediation actions\n\n```typescript\n// Step 1: Create a policy definition\nconst policyDef = new PolicyDefinition(this, \"policy\", {\n  name: \"my-policy\",\n  policyRule: {\n    /* ... */\n  },\n});\n\n// Step 2: Assign the policy to a scope\nconst assignment = new PolicyAssignment(this, \"assignment\", {\n  name: \"my-assignment\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/...\",\n});\n\n// Step 3: Monitor compliance via Azure Portal or API\n```\n\n## Related Constructs\n\n- **Policy Definitions**: Define the rules and effects to enforce\n- **Role Assignments**: Grant permissions for managed identities to perform remediation\n- **Resource Groups**: Common scope for policy assignments\n- **Management Groups**: Higher-level scope for organization-wide policies\n\n## Troubleshooting\n\n### Common Issues\n\n1. **Policy Not Taking Effect**\n\n   - Allow time for policy evaluation (15-30 minutes)\n   - Check enforcement mode (DoNotEnforce vs Default)\n   - Verify scope is correct\n   - Check for exclusions in notScopes\n\n2. **Remediation Failures**\n\n   - Verify managed identity is configured\n   - Check RBAC permissions for the identity\n   - Review deployment template in policy definition\n   - Check Azure Activity Log for detailed errors\n\n3. **Compliance Not Showing**\n\n   - Wait for compliance evaluation cycle\n   - Trigger manual compliance scan\n   - Verify assignment is deployed successfully\n   - Check assignment scope matches resources\n\n4. **Parameter Errors**\n   - Ensure parameter types match policy definition\n   - Check parameter names are correct\n   - Verify values are in allowed ranges\n   - Review parameter schema in policy definition\n\n## Contributing\n\nContributions are welcome! Please refer to the main project's contributing guidelines.\n\n## License\n\nThis project is licensed under the MIT License - see the LICENSE file for details."
+        "markdown": "# Azure Policy Assignment Construct\n\nThis module provides a unified, version-aware implementation for managing Azure Policy Assignments using the AZAPI provider and CDK for Terraform.\n\n## Overview\n\nAzure Policy Assignments apply policy definitions to specific scopes (management group, subscription, resource group, or resource) and provide parameter values for policy enforcement. Policy assignments can configure enforcement modes, managed identities for remediation, and custom non-compliance messages.\n\n## Key Features\n\n- **AZAPI Provider Integration**: Direct ARM API access for reliable deployments\n- **Version-Aware**: Automatically uses the latest stable API version (2022-06-01)\n- **Schema-Driven Validation**: Built-in validation based on Azure API schemas\n- **Type-Safe**: Full TypeScript support with comprehensive interfaces\n- **JSII Compatible**: Can be used from multiple programming languages\n- **Flexible Scoping**: Support for management group, subscription, resource group, and resource-level assignments\n- **Enforcement Modes**: Control whether policies are enforced or audited\n- **Managed Identity Support**: Enable remediation for deployIfNotExists and modify policies\n- **Scope Exclusions**: Exclude specific scopes from policy evaluation\n\n## AZAPI Provider Benefits\n\nThis construct uses the AZAPI provider, which offers several advantages:\n\n1. **Direct ARM API Access**: Communicates directly with Azure Resource Manager APIs\n2. **Faster Updates**: New Azure features are available immediately without provider updates\n3. **Consistent Behavior**: Matches Azure's native behavior exactly\n4. **Better Error Messages**: Detailed error messages directly from Azure\n5. **Version Flexibility**: Easily pin to specific API versions for stability\n\n## Installation\n\nThis package is part of the `@microsoft/terraform-cdk-constructs` library.\n\n```bash\nnpm install @microsoft/terraform-cdk-constructs\n```\n\n## Basic Usage\n\n### Simple Policy Assignment\n\n```typescript\nimport { App, TerraformStack } from \"cdktf\";\nimport { AzapiProvider } from \"@microsoft/terraform-cdk-constructs/core-azure\";\nimport { PolicyDefinition } from \"@microsoft/terraform-cdk-constructs/azure-policydefinition\";\nimport { PolicyAssignment } from \"@microsoft/terraform-cdk-constructs/azure-policyassignment\";\n\nclass MyStack extends TerraformStack {\n  constructor(scope: App, name: string) {\n    super(scope, name);\n\n    // Configure the AZAPI provider\n    new AzapiProvider(this, \"azapi\", {});\n\n    // First create or reference a policy definition\n    const policyDef = new PolicyDefinition(this, \"require-tags\", {\n      name: \"require-environment-tag\",\n      policyRule: {\n        if: {\n          field: \"tags['Environment']\",\n          exists: \"false\",\n        },\n        then: {\n          effect: \"deny\",\n        },\n      },\n    });\n\n    // Then assign the policy to a scope\n    const assignment = new PolicyAssignment(this, \"tag-assignment\", {\n      name: \"require-tags-on-rg\",\n      displayName: \"Require Environment Tag on Resources\",\n      description: \"Ensures all resources in this resource group have an Environment tag\",\n      policyDefinitionId: policyDef.id,\n      scope: \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg\",\n    });\n\n    console.log(\"Assignment ID:\", assignment.id);\n  }\n}\n\nconst app = new App();\nnew MyStack(app, \"my-stack\");\napp.synth();\n```\n\n### Assignment with Parameters\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"tag-assignment\", {\n  name: \"require-environment-tag\",\n  displayName: \"Require Environment Tag\",\n  policyDefinitionId: parameterizedPolicyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  parameters: {\n    tagName: {\n      value: \"Environment\",\n    },\n    allowedValues: {\n      value: [\"Development\", \"Staging\", \"Production\"],\n    },\n    effect: {\n      value: \"deny\",\n    },\n  },\n});\n```\n\n### Assignment with Built-in Policy\n\n```typescript\n// Reference a built-in Azure policy\nconst assignment = new PolicyAssignment(this, \"builtin-assignment\", {\n  name: \"audit-vm-managed-disks\",\n  displayName: \"Audit VMs without Managed Disks\",\n  policyDefinitionId:\n    \"/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d\",\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  enforcementMode: \"Default\",\n});\n```\n\n## Advanced Features\n\n### Enforcement Modes\n\nControl whether the policy is enforced or only audited:\n\n```typescript\n// Audit mode - policy is evaluated but not enforced\nconst auditAssignment = new PolicyAssignment(this, \"audit-assignment\", {\n  name: \"audit-policy\",\n  displayName: \"Audit Policy (DoNotEnforce)\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  enforcementMode: \"DoNotEnforce\", // Audit only\n});\n\n// Enforcement mode - policy is actively enforced (default)\nconst enforceAssignment = new PolicyAssignment(this, \"enforce-assignment\", {\n  name: \"enforce-policy\",\n  displayName: \"Enforce Policy (Default)\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  enforcementMode: \"Default\", // Actively enforced\n});\n```\n\n### Managed Identity for Remediation\n\nFor policies with deployIfNotExists or modify effects, add a managed identity:\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"remediation-assignment\", {\n  name: \"deploy-vm-monitoring\",\n  displayName: \"Deploy VM Monitoring Extension\",\n  policyDefinitionId: deployPolicyId,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  identity: {\n    type: \"SystemAssigned\",\n  },\n});\n\n// Or use a user-assigned identity\nconst userIdentityAssignment = new PolicyAssignment(\n  this,\n  \"user-identity-assignment\",\n  {\n    name: \"deploy-with-user-identity\",\n    policyDefinitionId: deployPolicyId,\n    scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n    identity: {\n      type: \"UserAssigned\",\n      userAssignedIdentities: {\n        \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity\":\n          {},\n      },\n    },\n  },\n);\n```\n\n### Scope Exclusions\n\nExclude specific scopes from policy evaluation:\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"with-exclusions\", {\n  name: \"subscription-policy-with-exclusions\",\n  displayName: \"Subscription Policy with Exclusions\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  notScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/excluded-rg\",\n    \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg\",\n  ],\n});\n```\n\n### Custom Non-Compliance Messages\n\nProvide helpful messages when resources are non-compliant:\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"with-messages\", {\n  name: \"tag-policy\",\n  displayName: \"Require Resource Tags\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  nonComplianceMessages: [\n    {\n      message:\n        \"All resources must have the required tags. Please add the Environment tag with an appropriate value.\",\n    },\n  ],\n});\n```\n\n### Explicit API Version\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"pinned-version\", {\n  name: \"my-assignment\",\n  apiVersion: \"2022-06-01\", // Pin to specific version for stability\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n});\n```\n\n### Using Outputs\n\n```typescript\nconst assignment = new PolicyAssignment(this, \"assignment\", {\n  name: \"my-assignment\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n});\n\n// Use the assignment ID in other resources\nnew TerraformOutput(this, \"assignment-id\", {\n  value: assignment.id,\n});\n\n// Access assignment properties\nconsole.log(\"Policy Definition ID:\", assignment.policyDefinitionId);\nconsole.log(\"Assignment Scope:\", assignment.assignmentScope);\nconsole.log(\"Enforcement Mode:\", assignment.enforcementMode);\n```\n\n## Complete Properties Documentation\n\n### PolicyAssignmentProps\n\n| Property                 | Type     | Required | Default   | Description                                           |\n| ------------------------ | -------- | -------- | --------- | ----------------------------------------------------- |\n| `name`                   | string   | No\\*     | Construct | Name of the policy assignment                         |\n| `policyDefinitionId`     | string   | **Yes**  | -         | ID of the policy definition to assign                 |\n| `scope`                  | string   | **Yes**  | -         | Scope where the policy is assigned                    |\n| `displayName`            | string   | No       | -         | Display name for the assignment                       |\n| `description`            | string   | No       | -         | Description of the assignment                         |\n| `enforcementMode`        | string   | No       | \"Default\" | Default or DoNotEnforce                               |\n| `parameters`             | object   | No       | -         | Parameter values for the policy                       |\n| `metadata`               | object   | No       | -         | Additional metadata                                   |\n| `identity`               | object   | No       | -         | Managed identity configuration                        |\n| `notScopes`              | string[] | No       | -         | Scopes to exclude from policy evaluation              |\n| `nonComplianceMessages`  | array    | No       | -         | Custom non-compliance messages                        |\n| `apiVersion`             | string   | No       | latest    | Specific API version to use                           |\n| `ignoreChanges`          | string[] | No       | -         | Properties to ignore during Terraform updates         |\n| `enableValidation`       | boolean  | No       | true      | Enable schema validation                              |\n| `enableMigrationAnalysis`| boolean  | No       | false     | Enable migration analysis between versions            |\n| `enableTransformation`   | boolean  | No       | true      | Enable property transformation                        |\n\n\\*If `name` is not provided, the construct ID will be used as the assignment name.\n\n## Supported API Versions\n\n| Version    | Support Level | Release Date | Notes                               |\n| ---------- | ------------- | ------------ | ----------------------------------- |\n| 2022-06-01 | Active        | 2022-06-01   | Latest stable version (recommended) |\n\n## Policy Assignment Concepts\n\n### Scoping Levels\n\nPolicy assignments can be applied at different organizational levels:\n\n#### Management Group Scope\n\n```typescript\nscope: \"/providers/Microsoft.Management/managementGroups/my-mg\";\n```\n\nApplies to all subscriptions and resources within the management group hierarchy. This is the highest level scope and is ideal for organization-wide policies.\n\n#### Subscription Scope\n\n```typescript\nscope: \"/subscriptions/00000000-0000-0000-0000-000000000000\";\n```\n\nApplies to all resources in the subscription (unless excluded via notScopes)\n\n#### Resource Group Scope\n\n```typescript\nscope:\n  \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg\";\n```\n\nApplies to all resources in the resource group\n\n#### Resource Scope\n\n```typescript\nscope:\n  \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.Storage/storageAccounts/mystorage\";\n```\n\nApplies to a specific resource\n\n### Enforcement Modes\n\n- **Default**: Policy effect is enforced during resource creation/update (deny, modify, deployIfNotExists)\n- **DoNotEnforce**: Policy is evaluated but the effect is not enforced (audit only mode)\n\nUse DoNotEnforce to test policies without impacting resources, then switch to Default when ready.\n\n### Identity Types\n\nManaged identities are required for policy assignments that use deployIfNotExists or modify effects:\n\n- **SystemAssigned**: Azure automatically creates and manages an identity for the assignment\n- **UserAssigned**: You provide an existing managed identity\n- **None**: No identity (use for audit and deny policies)\n\nThe identity needs appropriate RBAC permissions (typically Contributor or specific resource permissions) to perform remediation actions.\n\n## Available Outputs\n\nPolicy Assignment constructs expose the following outputs:\n\n- `id`: The Azure resource ID of the policy assignment\n- `name`: The name of the policy assignment\n- `resourceId`: Alias for the ID (for consistency with other constructs)\n- `policyDefinitionId`: The ID of the assigned policy definition\n- `assignmentScope`: The scope where the policy is assigned\n- `enforcementMode`: The enforcement mode of the assignment\n\n## Best Practices\n\n1. **Start with DoNotEnforce Mode**\n\n   - Test new assignments in audit mode first\n   - Monitor compliance reports before enforcing\n   - Gradually roll out enforcement after validation\n\n2. **Use Descriptive Names**\n\n   - Make assignment purpose clear from the name\n   - Include scope information in display name\n   - Document the assignment's intent\n\n3. **Provide Non-Compliance Messages**\n\n   - Help users understand why resources are non-compliant\n   - Include remediation steps in messages\n   - Be specific and actionable\n\n4. **Scope Appropriately**\n\n   - Apply policies at the right organizational level\n   - Use subscription scope for organization-wide policies\n   - Use resource group scope for environment-specific policies\n\n5. **Use Parameters Effectively**\n\n   - Reuse policy definitions with different parameter values\n   - Provide appropriate defaults in policy definitions\n   - Document parameter requirements\n\n6. **Configure Identity Correctly**\n\n   - Add managed identity for deployIfNotExists and modify policies\n   - Grant minimum required permissions (least privilege)\n   - Use user-assigned identities for shared remediation scenarios\n\n7. **Monitor and Review**\n\n   - Regularly review compliance reports\n   - Address non-compliant resources\n   - Update policies and assignments as requirements change\n\n8. **Document Exclusions**\n   - Clearly document why scopes are excluded\n   - Regularly review exclusions for continued validity\n   - Minimize the use of exclusions\n\n## Examples\n\n### Assign Policy at Management Group Level\n\n```typescript\n// Apply an organization-wide policy at management group scope\nconst mgPolicyDefinition = new PolicyDefinition(this, \"org-policy\", {\n  name: \"require-resource-tags\",\n  parentId: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  displayName: \"Require Resource Tags\",\n  policyRule: {\n    if: {\n      field: \"tags['CostCenter']\",\n      exists: \"false\",\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n\nconst mgAssignment = new PolicyAssignment(this, \"mg-tag-assignment\", {\n  name: \"require-tags-org-wide\",\n  displayName: \"Require Tags Across Organization\",\n  description: \"Enforces required tags across all subscriptions in the management group\",\n  policyDefinitionId: mgPolicyDefinition.id,\n  scope: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  nonComplianceMessages: [\n    {\n      message:\n        \"All resources must have a CostCenter tag for billing and cost allocation purposes.\",\n    },\n  ],\n});\n```\n\n### Assign Tag Policy at Subscription Level\n\n```typescript\nconst tagPolicy = new PolicyDefinition(this, \"tag-policy\", {\n  name: \"require-cost-center\",\n  policyRule: {\n    if: {\n      field: \"tags['CostCenter']\",\n      exists: \"false\",\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n\nconst tagAssignment = new PolicyAssignment(this, \"sub-tag-assignment\", {\n  name: \"require-cost-center-sub\",\n  displayName: \"Require CostCenter Tag on All Resources\",\n  description: \"Denies resource creation without CostCenter tag\",\n  policyDefinitionId: tagPolicy.id,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  nonComplianceMessages: [\n    {\n      message:\n        \"Resources must have a CostCenter tag for billing purposes. Contact your team lead for the appropriate cost center code.\",\n    },\n  ],\n});\n```\n\n### Audit Mode Testing\n\n```typescript\n// Test a policy in audit mode before enforcing\nconst testAssignment = new PolicyAssignment(this, \"test-assignment\", {\n  name: \"test-location-policy\",\n  displayName: \"Test Location Restriction (Audit Only)\",\n  description: \"Testing location policy in audit mode\",\n  policyDefinitionId: locationPolicyId,\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg\",\n  enforcementMode: \"DoNotEnforce\", // Audit only\n  metadata: {\n    testPhase: \"audit\",\n    plannedEnforcement: \"2024-02-01\",\n  },\n});\n```\n\n### Remediation with Managed Identity\n\n```typescript\nconst remediationPolicy = new PolicyDefinition(this, \"deploy-backup\", {\n  name: \"deploy-vm-backup\",\n  policyRule: {\n    if: {\n      field: \"type\",\n      equals: \"Microsoft.Compute/virtualMachines\",\n    },\n    then: {\n      effect: \"deployIfNotExists\",\n      details: {\n        type: \"Microsoft.RecoveryServices/backupprotecteditems\",\n        deploymentScope: \"subscription\",\n        // ... deployment template\n      },\n    },\n  },\n});\n\nconst remediationAssignment = new PolicyAssignment(\n  this,\n  \"backup-assignment\",\n  {\n    name: \"deploy-vm-backup-assignment\",\n    displayName: \"Deploy VM Backup Configuration\",\n    description:\n      \"Automatically deploys backup configuration for virtual machines\",\n    policyDefinitionId: remediationPolicy.id,\n    scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n    identity: {\n      type: \"SystemAssigned\",\n    },\n  },\n);\n\n// Note: You would also need to create a role assignment to grant\n// the managed identity permissions to deploy backup configurations\n```\n\n### Multiple Assignments for Different Environments\n\n```typescript\nconst environments = [\"dev\", \"staging\", \"prod\"];\n\nenvironments.forEach((env) => {\n  const rgScope = `/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/${env}-rg`;\n\n  new PolicyAssignment(this, `${env}-assignment`, {\n    name: `require-tags-${env}`,\n    displayName: `Require Tags in ${env.toUpperCase()} Environment`,\n    policyDefinitionId: tagPolicyId,\n    scope: rgScope,\n    parameters: {\n      environmentTag: {\n        value: env,\n      },\n    },\n    metadata: {\n      environment: env,\n      assignedBy: \"terraform-cdk\",\n    },\n  });\n});\n```\n\n## Relationship with Policy Definitions\n\nPolicy Assignments apply Policy Definitions to specific scopes. The typical workflow is:\n\n1. **Create or Reference a Policy Definition**: Define the rules and conditions\n2. **Create a Policy Assignment**: Apply the definition to a scope with specific parameters\n3. **Monitor Compliance**: Review compliance reports and take remediation actions\n\n```typescript\n// Step 1: Create a policy definition\nconst policyDef = new PolicyDefinition(this, \"policy\", {\n  name: \"my-policy\",\n  policyRule: {\n    /* ... */\n  },\n});\n\n// Step 2: Assign the policy to a scope\nconst assignment = new PolicyAssignment(this, \"assignment\", {\n  name: \"my-assignment\",\n  policyDefinitionId: policyDef.id,\n  scope: \"/subscriptions/...\",\n});\n\n// Step 3: Monitor compliance via Azure Portal or API\n```\n\n## Related Constructs\n\n- **Policy Definitions**: Define the rules and effects to enforce\n- **Role Assignments**: Grant permissions for managed identities to perform remediation\n- **Resource Groups**: Common scope for policy assignments\n- **Management Groups**: Higher-level scope for organization-wide policies\n\n## Troubleshooting\n\n### Common Issues\n\n1. **Policy Not Taking Effect**\n\n   - Allow time for policy evaluation (15-30 minutes)\n   - Check enforcement mode (DoNotEnforce vs Default)\n   - Verify scope is correct\n   - Check for exclusions in notScopes\n\n2. **Remediation Failures**\n\n   - Verify managed identity is configured\n   - Check RBAC permissions for the identity\n   - Review deployment template in policy definition\n   - Check Azure Activity Log for detailed errors\n\n3. **Compliance Not Showing**\n\n   - Wait for compliance evaluation cycle\n   - Trigger manual compliance scan\n   - Verify assignment is deployed successfully\n   - Check assignment scope matches resources\n\n4. **Parameter Errors**\n   - Ensure parameter types match policy definition\n   - Check parameter names are correct\n   - Verify values are in allowed ranges\n   - Review parameter schema in policy definition\n\n## Contributing\n\nContributions are welcome! Please refer to the main project's contributing guidelines.\n\n## License\n\nThis project is licensed under the MIT License - see the LICENSE file for details."
       },
       "symbolId": "src/azure-policyassignment/index:"
     },
@@ -221,7 +221,7 @@
         "line": 47
       },
       "readme": {
-        "markdown": "# Azure Policy Definition Construct\n\nThis module provides a unified, version-aware implementation for managing Azure Policy Definitions using the AZAPI provider and CDK for Terraform.\n\n## Overview\n\nAzure Policy Definitions are rules that enforce specific conditions and effects on Azure resources. They are deployed at subscription or management group scope and can be used to ensure compliance with organizational standards.\n\n## Key Features\n\n- **AZAPI Provider Integration**: Direct ARM API access for reliable deployments\n- **Version-Aware**: Automatically uses the latest stable API version (2021-06-01)\n- **Schema-Driven Validation**: Built-in validation based on Azure API schemas\n- **Type-Safe**: Full TypeScript support with comprehensive interfaces\n- **JSII Compatible**: Can be used from multiple programming languages\n- **Flexible Policy Rules**: Support for simple and complex policy logic\n- **Parameterized Policies**: Create reusable policies with parameters\n\n## AZAPI Provider Benefits\n\nThis construct uses the AZAPI provider, which offers several advantages:\n\n1. **Direct ARM API Access**: Communicates directly with Azure Resource Manager APIs\n2. **Faster Updates**: New Azure features are available immediately without provider updates\n3. **Consistent Behavior**: Matches Azure's native behavior exactly\n4. **Better Error Messages**: Detailed error messages directly from Azure\n5. **Version Flexibility**: Easily pin to specific API versions for stability\n\n## Installation\n\nThis package is part of the `@microsoft/terraform-cdk-constructs` library.\n\n```bash\nnpm install @microsoft/terraform-cdk-constructs\n```\n\n## Basic Usage\n\n### Simple Policy Definition\n\n```typescript\nimport { App, TerraformStack } from \"cdktf\";\nimport { AzapiProvider } from \"@microsoft/terraform-cdk-constructs/core-azure\";\nimport { PolicyDefinition } from \"@microsoft/terraform-cdk-constructs/azure-policydefinition\";\n\nclass MyStack extends TerraformStack {\n  constructor(scope: App, name: string) {\n    super(scope, name);\n\n    // Configure the AZAPI provider\n    new AzapiProvider(this, \"azapi\", {});\n\n    // Create a simple policy definition\n    const policyDefinition = new PolicyDefinition(this, \"require-tags\", {\n      name: \"require-environment-tag\",\n      displayName: \"Require Environment Tag\",\n      description: \"Ensures all resources have an Environment tag\",\n      policyType: \"Custom\",\n      mode: \"Indexed\",\n      policyRule: {\n        if: {\n          field: \"tags['Environment']\",\n          exists: \"false\",\n        },\n        then: {\n          effect: \"deny\",\n        },\n      },\n      metadata: {\n        category: \"Tags\",\n        version: \"1.0.0\",\n      },\n    });\n\n    console.log(\"Policy ID:\", policyDefinition.id);\n  }\n}\n\nconst app = new App();\nnew MyStack(app, \"my-stack\");\napp.synth();\n```\n\n### Policy Definition with Parameters\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"tag-policy\", {\n  name: \"require-tag-with-values\",\n  displayName: \"Require Tag with Specific Values\",\n  description: \"Ensures resources have a tag with an allowed value\",\n  policyRule: {\n    if: {\n      allOf: [\n        {\n          field: \"[concat('tags[', parameters('tagName'), ']')]\",\n          exists: \"true\",\n        },\n        {\n          field: \"[concat('tags[', parameters('tagName'), ']')]\",\n          notIn: \"[parameters('allowedValues')]\",\n        },\n      ],\n    },\n    then: {\n      effect: \"[parameters('effect')]\",\n    },\n  },\n  parameters: {\n    tagName: {\n      type: \"String\",\n      metadata: {\n        displayName: \"Tag Name\",\n        description: \"Name of the tag to check\",\n      },\n      defaultValue: \"CostCenter\",\n    },\n    allowedValues: {\n      type: \"Array\",\n      metadata: {\n        displayName: \"Allowed Values\",\n        description: \"List of allowed tag values\",\n      },\n      defaultValue: [\"Engineering\", \"Marketing\", \"Operations\"],\n    },\n    effect: {\n      type: \"String\",\n      metadata: {\n        displayName: \"Effect\",\n        description: \"The effect of the policy (audit or deny)\",\n      },\n      allowedValues: [\"audit\", \"deny\"],\n      defaultValue: \"audit\",\n    },\n  },\n  metadata: {\n    category: \"Tags\",\n    version: \"1.0.0\",\n  },\n});\n```\n\n## Advanced Features\n\n### Complex Policy Rules\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"storage-policy\", {\n  name: \"require-https-storage\",\n  displayName: \"Require HTTPS for Storage Accounts\",\n  description: \"Denies storage accounts that don't enforce HTTPS\",\n  mode: \"Indexed\",\n  policyRule: {\n    if: {\n      allOf: [\n        {\n          field: \"type\",\n          equals: \"Microsoft.Storage/storageAccounts\",\n        },\n        {\n          field: \"Microsoft.Storage/storageAccounts/enableHttpsTrafficOnly\",\n          notEquals: \"true\",\n        },\n      ],\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n  metadata: {\n    category: \"Storage\",\n    version: \"1.0.0\",\n  },\n});\n```\n\n### Explicit API Version\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"policy\", {\n  name: \"my-policy\",\n  apiVersion: \"2021-06-01\", // Pin to specific version for stability\n  policyRule: {\n    if: {\n      field: \"location\",\n      notIn: [\"eastus\", \"westus\"],\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n```\n\n### Using Outputs\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"policy\", {\n  name: \"my-policy\",\n  policyRule: {\n    /* ... */\n  },\n});\n\n// Use the policy definition ID in other resources\nnew TerraformOutput(this, \"policy-id\", {\n  value: policyDefinition.id,\n});\n\n// Access policy properties\nconsole.log(\"Policy Type:\", policyDefinition.policyType);\nconsole.log(\"Policy Mode:\", policyDefinition.policyMode);\n```\n\n## Complete Properties Documentation\n\n### PolicyDefinitionProps\n\n| Property | Type | Required | Default | Description |\n| -------- | ---- | -------- | ------- | ----------- |\n| `name` | string | No* | Construct ID | Name of the policy definition |\n| `policyRule` | object | **Yes** | - | The policy rule JSON object defining if/then logic |\n| `displayName` | string | No | - | Display name for the policy in Azure Portal |\n| `description` | string | No | - | Description of what the policy enforces |\n| `policyType` | string | No | \"Custom\" | Type of policy: Custom, BuiltIn, Static, NotSpecified |\n| `mode` | string | No | \"All\" | Policy mode: All, Indexed, or resource provider modes |\n| `parameters` | object | No | - | Parameters that can be passed to policy assignments |\n| `metadata` | object | No | - | Additional metadata (category, version, etc.) |\n| `apiVersion` | string | No | \"2021-06-01\" | Specific API version to use |\n| `ignoreChanges` | string[] | No | - | Properties to ignore during Terraform updates |\n| `enableValidation` | boolean | No | true | Enable schema validation |\n| `enableMigrationAnalysis` | boolean | No | false | Enable migration analysis between versions |\n| `enableTransformation` | boolean | No | true | Enable property transformation |\n\n*If `name` is not provided, the construct ID will be used as the policy definition name.\n\n## Supported API Versions\n\n| Version    | Support Level | Release Date | Notes                                   |\n| ---------- | ------------- | ------------ | --------------------------------------- |\n| 2021-06-01 | Active        | 2021-06-01   | Latest stable version (recommended)     |\n\n## Policy Definition Concepts\n\n### Policy Types\n\n- **Custom**: User-defined policies (default) - Used for organization-specific requirements\n- **BuiltIn**: Azure-provided policies - Pre-defined policies from Microsoft\n- **Static**: Static policy definitions - Policies that don't change\n- **NotSpecified**: Type not specified\n\n### Policy Modes\n\n- **All**: Evaluates all resource types (default) - Most common mode\n- **Indexed**: Only evaluates resource types that support tags and location\n- **Resource Provider Modes**: Specific modes like `Microsoft.KeyVault.Data` for data plane operations\n\n### Policy Effects\n\nCommon effects used in the `then` clause of policy rules:\n\n- **deny**: Blocks the resource request\n- **audit**: Logs a warning but allows the request (useful for testing)\n- **append**: Adds additional properties to the resource\n- **modify**: Modifies the resource properties\n- **deployIfNotExists**: Deploys resources if they don't exist\n- **auditIfNotExists**: Audits if resources don't exist\n- **disabled**: Disables the policy\n\n### Policy Rule Structure\n\nA policy rule consists of two main parts:\n\n```typescript\n{\n  if: {\n    // Condition(s) to evaluate\n    field: \"type\",\n    equals: \"Microsoft.Storage/storageAccounts\"\n  },\n  then: {\n    // Action to take if condition is true\n    effect: \"deny\"\n  }\n}\n```\n\nConditions can use:\n- `field`: Resource property to evaluate\n- `equals`, `notEquals`: Exact matching\n- `in`, `notIn`: Array matching\n- `contains`, `notContains`: Substring matching\n- `exists`: Check if property exists\n- `allOf`, `anyOf`: Logical operators for multiple conditions\n\n## Available Outputs\n\nPolicy Definition constructs expose the following outputs:\n\n- `id`: The Azure resource ID of the policy definition\n- `name`: The name of the policy definition\n- `resourceId`: Alias for the ID (for consistency with other constructs)\n- `policyType`: The type of policy definition (Custom, BuiltIn, etc.)\n- `policyMode`: The mode of the policy definition (All, Indexed, etc.)\n\n## Best Practices\n\n1. **Use Descriptive Names and Display Names**\n   - Make policy purpose clear from the name\n   - Include version information in metadata\n\n2. **Start with Audit Effect**\n   - Test new policies with `audit` effect first\n   - Monitor audit logs before switching to `deny`\n\n3. **Add Comprehensive Metadata**\n   - Include category for organization\n   - Add version for tracking changes\n   - Document purpose and scope\n\n4. **Make Policies Reusable**\n   - Use parameters for flexibility\n   - Provide sensible default values\n   - Document parameter usage\n\n5. **Test Thoroughly**\n   - Use integration tests before production\n   - Test with various resource types\n   - Verify parameter combinations\n\n6. **Document Policy Logic**\n   - Provide clear descriptions\n   - Document any exceptions or special cases\n   - Include examples in metadata\n\n7. **Use Appropriate Policy Modes**\n   - Use `Indexed` for resource-level policies\n   - Use `All` when location/tags don't apply\n   - Use resource provider modes for data plane policies\n\n8. **Version Control**\n   - Store policy definitions in source control\n   - Use semantic versioning in metadata\n   - Document breaking changes\n\n## Examples\n\n### Require Specific Resource Locations\n\n```typescript\nnew PolicyDefinition(this, \"allowed-locations\", {\n  name: \"allowed-resource-locations\",\n  displayName: \"Allowed Resource Locations\",\n  description: \"Restricts resources to approved Azure regions\",\n  policyRule: {\n    if: {\n      field: \"location\",\n      notIn: [\"eastus\", \"westus\", \"centralus\"],\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n```\n\n### Enforce Naming Conventions\n\n```typescript\nnew PolicyDefinition(this, \"naming-convention\", {\n  name: \"enforce-naming-convention\",\n  displayName: \"Enforce Resource Naming Convention\",\n  policyRule: {\n    if: {\n      field: \"name\",\n      notMatch: \"^[a-z0-9-]+$\",\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n```\n\n### Audit Missing Tags\n\n```typescript\nnew PolicyDefinition(this, \"audit-tags\", {\n  name: \"audit-required-tags\",\n  displayName: \"Audit Resources Missing Required Tags\",\n  policyRule: {\n    if: {\n      anyOf: [\n        {\n          field: \"tags['CostCenter']\",\n          exists: \"false\",\n        },\n        {\n          field: \"tags['Environment']\",\n          exists: \"false\",\n        },\n      ],\n    },\n    then: {\n      effect: \"audit\",\n    },\n  },\n});\n```\n\n## Related Constructs\n\n- **Policy Assignments**: Use policy definitions by assigning them to scopes (subscriptions, resource groups)\n- **Role Definitions**: Define custom RBAC roles for Azure resources\n- **Role Assignments**: Assign roles to identities for access control\n\n## Troubleshooting\n\n### Common Issues\n\n1. **Policy Not Taking Effect**\n   - Check policy assignment scope\n   - Verify policy mode matches resource type\n   - Allow time for policy evaluation (can take 15-30 minutes)\n\n2. **Validation Errors**\n   - Ensure policyRule is valid JSON\n   - Check parameter types and values\n   - Verify field names match Azure resource properties\n\n3. **Scope Issues**\n   - Policy definitions are subscription-scoped\n   - Ensure proper RBAC permissions\n   - Check management group hierarchy if applicable\n\n## Contributing\n\nContributions are welcome! Please refer to the main project's contributing guidelines.\n\n## License\n\nThis project is licensed under the MIT License - see the LICENSE file for details."
+        "markdown": "# Azure Policy Definition Construct\n\nThis module provides a unified, version-aware implementation for managing Azure Policy Definitions using the AZAPI provider and CDK for Terraform.\n\n## Overview\n\nAzure Policy Definitions are rules that enforce specific conditions and effects on Azure resources. They are deployed at subscription or management group scope and can be used to ensure compliance with organizational standards.\n\n## Key Features\n\n- **AZAPI Provider Integration**: Direct ARM API access for reliable deployments\n- **Version-Aware**: Automatically uses the latest stable API version (2021-06-01)\n- **Schema-Driven Validation**: Built-in validation based on Azure API schemas\n- **Type-Safe**: Full TypeScript support with comprehensive interfaces\n- **JSII Compatible**: Can be used from multiple programming languages\n- **Flexible Policy Rules**: Support for simple and complex policy logic\n- **Parameterized Policies**: Create reusable policies with parameters\n\n## AZAPI Provider Benefits\n\nThis construct uses the AZAPI provider, which offers several advantages:\n\n1. **Direct ARM API Access**: Communicates directly with Azure Resource Manager APIs\n2. **Faster Updates**: New Azure features are available immediately without provider updates\n3. **Consistent Behavior**: Matches Azure's native behavior exactly\n4. **Better Error Messages**: Detailed error messages directly from Azure\n5. **Version Flexibility**: Easily pin to specific API versions for stability\n\n## Installation\n\nThis package is part of the `@microsoft/terraform-cdk-constructs` library.\n\n```bash\nnpm install @microsoft/terraform-cdk-constructs\n```\n\n## Basic Usage\n\n### Simple Policy Definition\n\n```typescript\nimport { App, TerraformStack } from \"cdktf\";\nimport { AzapiProvider } from \"@microsoft/terraform-cdk-constructs/core-azure\";\nimport { PolicyDefinition } from \"@microsoft/terraform-cdk-constructs/azure-policydefinition\";\n\nclass MyStack extends TerraformStack {\n  constructor(scope: App, name: string) {\n    super(scope, name);\n\n    // Configure the AZAPI provider\n    new AzapiProvider(this, \"azapi\", {});\n\n    // Create a simple policy definition\n    const policyDefinition = new PolicyDefinition(this, \"require-tags\", {\n      name: \"require-environment-tag\",\n      displayName: \"Require Environment Tag\",\n      description: \"Ensures all resources have an Environment tag\",\n      policyType: \"Custom\",\n      mode: \"Indexed\",\n      policyRule: {\n        if: {\n          field: \"tags['Environment']\",\n          exists: \"false\",\n        },\n        then: {\n          effect: \"deny\",\n        },\n      },\n      metadata: {\n        category: \"Tags\",\n        version: \"1.0.0\",\n      },\n    });\n\n    console.log(\"Policy ID:\", policyDefinition.id);\n  }\n}\n\nconst app = new App();\nnew MyStack(app, \"my-stack\");\napp.synth();\n```\n\n### Policy Definition with Parameters\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"tag-policy\", {\n  name: \"require-tag-with-values\",\n  displayName: \"Require Tag with Specific Values\",\n  description: \"Ensures resources have a tag with an allowed value\",\n  policyRule: {\n    if: {\n      allOf: [\n        {\n          field: \"[concat('tags[', parameters('tagName'), ']')]\",\n          exists: \"true\",\n        },\n        {\n          field: \"[concat('tags[', parameters('tagName'), ']')]\",\n          notIn: \"[parameters('allowedValues')]\",\n        },\n      ],\n    },\n    then: {\n      effect: \"[parameters('effect')]\",\n    },\n  },\n  parameters: {\n    tagName: {\n      type: \"String\",\n      metadata: {\n        displayName: \"Tag Name\",\n        description: \"Name of the tag to check\",\n      },\n      defaultValue: \"CostCenter\",\n    },\n    allowedValues: {\n      type: \"Array\",\n      metadata: {\n        displayName: \"Allowed Values\",\n        description: \"List of allowed tag values\",\n      },\n      defaultValue: [\"Engineering\", \"Marketing\", \"Operations\"],\n    },\n    effect: {\n      type: \"String\",\n      metadata: {\n        displayName: \"Effect\",\n        description: \"The effect of the policy (audit or deny)\",\n      },\n      allowedValues: [\"audit\", \"deny\"],\n      defaultValue: \"audit\",\n    },\n  },\n  metadata: {\n    category: \"Tags\",\n    version: \"1.0.0\",\n  },\n});\n```\n\n## Advanced Features\n\n### Complex Policy Rules\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"storage-policy\", {\n  name: \"require-https-storage\",\n  displayName: \"Require HTTPS for Storage Accounts\",\n  description: \"Denies storage accounts that don't enforce HTTPS\",\n  mode: \"Indexed\",\n  policyRule: {\n    if: {\n      allOf: [\n        {\n          field: \"type\",\n          equals: \"Microsoft.Storage/storageAccounts\",\n        },\n        {\n          field: \"Microsoft.Storage/storageAccounts/enableHttpsTrafficOnly\",\n          notEquals: \"true\",\n        },\n      ],\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n  metadata: {\n    category: \"Storage\",\n    version: \"1.0.0\",\n  },\n});\n```\n\n### Explicit API Version\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"policy\", {\n  name: \"my-policy\",\n  apiVersion: \"2021-06-01\", // Pin to specific version for stability\n  policyRule: {\n    if: {\n      field: \"location\",\n      notIn: [\"eastus\", \"westus\"],\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n```\n\n### Using Outputs\n\n```typescript\nconst policyDefinition = new PolicyDefinition(this, \"policy\", {\n  name: \"my-policy\",\n  policyRule: {\n    /* ... */\n  },\n});\n\n// Use the policy definition ID in other resources\nnew TerraformOutput(this, \"policy-id\", {\n  value: policyDefinition.id,\n});\n\n// Access policy properties\nconsole.log(\"Policy Type:\", policyDefinition.policyType);\nconsole.log(\"Policy Mode:\", policyDefinition.policyMode);\n```\n\n## Complete Properties Documentation\n\n### PolicyDefinitionProps\n\n| Property | Type | Required | Default | Description |\n| -------- | ---- | -------- | ------- | ----------- |\n| `name` | string | No* | Construct ID | Name of the policy definition |\n| `policyRule` | object | **Yes** | - | The policy rule JSON object defining if/then logic |\n| `displayName` | string | No | - | Display name for the policy in Azure Portal |\n| `description` | string | No | - | Description of what the policy enforces |\n| `policyType` | string | No | \"Custom\" | Type of policy: Custom, BuiltIn, Static, NotSpecified |\n| `mode` | string | No | \"All\" | Policy mode: All, Indexed, or resource provider modes |\n| `parameters` | object | No | - | Parameters that can be passed to policy assignments |\n| `metadata` | object | No | - | Additional metadata (category, version, etc.) |\n| `apiVersion` | string | No | \"2021-06-01\" | Specific API version to use |\n| `ignoreChanges` | string[] | No | - | Properties to ignore during Terraform updates |\n| `enableValidation` | boolean | No | true | Enable schema validation |\n| `enableMigrationAnalysis` | boolean | No | false | Enable migration analysis between versions |\n| `enableTransformation` | boolean | No | true | Enable property transformation |\n\n*If `name` is not provided, the construct ID will be used as the policy definition name.\n\n## Supported API Versions\n\n| Version    | Support Level | Release Date | Notes                                   |\n| ---------- | ------------- | ------------ | --------------------------------------- |\n| 2021-06-01 | Active        | 2021-06-01   | Latest stable version (recommended)     |\n\n## Policy Definition Concepts\n\n### Policy Types\n\n- **Custom**: User-defined policies (default) - Used for organization-specific requirements\n- **BuiltIn**: Azure-provided policies - Pre-defined policies from Microsoft\n- **Static**: Static policy definitions - Policies that don't change\n- **NotSpecified**: Type not specified\n\n### Policy Modes\n\n- **All**: Evaluates all resource types (default) - Most common mode\n- **Indexed**: Only evaluates resource types that support tags and location\n- **Resource Provider Modes**: Specific modes like `Microsoft.KeyVault.Data` for data plane operations\n\n### Policy Effects\n\nCommon effects used in the `then` clause of policy rules:\n\n- **deny**: Blocks the resource request\n- **audit**: Logs a warning but allows the request (useful for testing)\n- **append**: Adds additional properties to the resource\n- **modify**: Modifies the resource properties\n- **deployIfNotExists**: Deploys resources if they don't exist\n- **auditIfNotExists**: Audits if resources don't exist\n- **disabled**: Disables the policy\n\n### Policy Rule Structure\n\nA policy rule consists of two main parts:\n\n```typescript\n{\n  if: {\n    // Condition(s) to evaluate\n    field: \"type\",\n    equals: \"Microsoft.Storage/storageAccounts\"\n  },\n  then: {\n    // Action to take if condition is true\n    effect: \"deny\"\n  }\n}\n```\n\nConditions can use:\n- `field`: Resource property to evaluate\n- `equals`, `notEquals`: Exact matching\n- `in`, `notIn`: Array matching\n- `contains`, `notContains`: Substring matching\n- `exists`: Check if property exists\n- `allOf`, `anyOf`: Logical operators for multiple conditions\n\n## Available Outputs\n\nPolicy Definition constructs expose the following outputs:\n\n- `id`: The Azure resource ID of the policy definition\n- `name`: The name of the policy definition\n- `resourceId`: Alias for the ID (for consistency with other constructs)\n- `policyType`: The type of policy definition (Custom, BuiltIn, etc.)\n- `policyMode`: The mode of the policy definition (All, Indexed, etc.)\n\n## Best Practices\n\n1. **Use Descriptive Names and Display Names**\n   - Make policy purpose clear from the name\n   - Include version information in metadata\n\n2. **Start with Audit Effect**\n   - Test new policies with `audit` effect first\n   - Monitor audit logs before switching to `deny`\n\n3. **Add Comprehensive Metadata**\n   - Include category for organization\n   - Add version for tracking changes\n   - Document purpose and scope\n\n4. **Make Policies Reusable**\n   - Use parameters for flexibility\n   - Provide sensible default values\n   - Document parameter usage\n\n5. **Test Thoroughly**\n   - Use integration tests before production\n   - Test with various resource types\n   - Verify parameter combinations\n\n6. **Document Policy Logic**\n   - Provide clear descriptions\n   - Document any exceptions or special cases\n   - Include examples in metadata\n\n7. **Use Appropriate Policy Modes**\n   - Use `Indexed` for resource-level policies\n   - Use `All` when location/tags don't apply\n   - Use resource provider modes for data plane policies\n\n8. **Version Control**\n   - Store policy definitions in source control\n   - Use semantic versioning in metadata\n   - Document breaking changes\n\n## Examples\n\n### Policy Definition at Management Group Scope\n\n```typescript\n// Create a policy definition at management group scope\n// This makes the policy available to all subscriptions under the management group\nnew PolicyDefinition(this, \"mg-policy\", {\n  name: \"org-wide-tag-policy\",\n  parentId: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  displayName: \"Organization-Wide Tag Policy\",\n  description: \"Enforces required tags across all subscriptions in the organization\",\n  policyRule: {\n    if: {\n      field: \"tags['CostCenter']\",\n      exists: \"false\",\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n  metadata: {\n    category: \"Tags\",\n    version: \"1.0.0\",\n  },\n});\n```\n\n### Require Specific Resource Locations\n\n```typescript\nnew PolicyDefinition(this, \"allowed-locations\", {\n  name: \"allowed-resource-locations\",\n  displayName: \"Allowed Resource Locations\",\n  description: \"Restricts resources to approved Azure regions\",\n  policyRule: {\n    if: {\n      field: \"location\",\n      notIn: [\"eastus\", \"westus\", \"centralus\"],\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n```\n\n### Enforce Naming Conventions\n\n```typescript\nnew PolicyDefinition(this, \"naming-convention\", {\n  name: \"enforce-naming-convention\",\n  displayName: \"Enforce Resource Naming Convention\",\n  policyRule: {\n    if: {\n      field: \"name\",\n      notMatch: \"^[a-z0-9-]+$\",\n    },\n    then: {\n      effect: \"deny\",\n    },\n  },\n});\n```\n\n### Audit Missing Tags\n\n```typescript\nnew PolicyDefinition(this, \"audit-tags\", {\n  name: \"audit-required-tags\",\n  displayName: \"Audit Resources Missing Required Tags\",\n  policyRule: {\n    if: {\n      anyOf: [\n        {\n          field: \"tags['CostCenter']\",\n          exists: \"false\",\n        },\n        {\n          field: \"tags['Environment']\",\n          exists: \"false\",\n        },\n      ],\n    },\n    then: {\n      effect: \"audit\",\n    },\n  },\n});\n```\n\n## Related Constructs\n\n- **Policy Assignments**: Use policy definitions by assigning them to scopes (subscriptions, resource groups)\n- **Role Definitions**: Define custom RBAC roles for Azure resources\n- **Role Assignments**: Assign roles to identities for access control\n\n## Troubleshooting\n\n### Common Issues\n\n1. **Policy Not Taking Effect**\n   - Check policy assignment scope\n   - Verify policy mode matches resource type\n   - Allow time for policy evaluation (can take 15-30 minutes)\n\n2. **Validation Errors**\n   - Ensure policyRule is valid JSON\n   - Check parameter types and values\n   - Verify field names match Azure resource properties\n\n3. **Scope Issues**\n   - Policy definitions are subscription-scoped\n   - Ensure proper RBAC permissions\n   - Check management group hierarchy if applicable\n\n## Contributing\n\nContributions are welcome! Please refer to the main project's contributing guidelines.\n\n## License\n\nThis project is licensed under the MIT License - see the LICENSE file for details."
       },
       "symbolId": "src/azure-policydefinition/index:"
     },
@@ -261,7 +261,7 @@
         "line": 51
       },
       "readme": {
-        "markdown": "# Azure Role Assignment Construct\n\nThis module provides a CDK construct for managing Azure Role Assignments using the AZAPI provider. Role assignments grant specific permissions (roles) to security principals (users, groups, service principals, managed identities) at a particular scope (subscription, resource group, or resource).\n\n## Table of Contents\n\n- [Features](#features)\n- [Installation](#installation)\n- [Basic Usage](#basic-usage)\n- [Advanced Usage](#advanced-usage)\n- [Properties](#properties)\n- [Outputs](#outputs)\n- [API Versions](#api-versions)\n- [Principal Types](#principal-types)\n- [Built-in Roles](#built-in-roles)\n- [Best Practices](#best-practices)\n- [Examples](#examples)\n\n## Features\n\n- **Version-Aware Resource Management**: Automatic API version resolution with support for explicit version pinning\n- **Schema-Driven Validation**: Built-in property validation with comprehensive error messages\n- **Principal Types**: Support for User, Group, ServicePrincipal, ForeignGroup, and Device principals\n- **Conditional Access (ABAC)**: Attribute-Based Access Control with condition expressions\n- **Flexible Scoping**: Assign roles at subscription, resource group, or individual resource scope\n- **Delegated Managed Identity**: Support for delegated identity scenarios with group assignments\n- **Built-in and Custom Roles**: Works with both Azure built-in roles and custom role definitions\n- **JSII Compliance**: Full support for multi-language bindings\n\n## Why Use AZAPI Provider?\n\nThe AZAPI provider offers several advantages for managing role assignments:\n\n1. **Latest API Support**: Access to the newest Azure features without waiting for provider updates\n2. **Consistent Interface**: Unified approach across all Azure resources\n3. **Version Flexibility**: Pin to specific API versions or use latest automatically\n4. **Full Feature Coverage**: Support for all Azure properties including preview features\n5. **Type Safety**: Strong typing and validation for all resource properties\n\n## Installation\n\nThis construct is part of the terraform-cdk-constructs library:\n\n```bash\nnpm install @microsoft/terraform-cdk-constructs\n```\n\n## Basic Usage\n\n### Assign Built-in Reader Role\n\n```typescript\nimport { RoleAssignment } from '@microsoft/terraform-cdk-constructs/azure-roleassignment';\nimport { AzapiProvider } from '@microsoft/terraform-cdk-constructs/core-azure';\n\n// Configure the AZAPI provider\nnew AzapiProvider(this, 'azapi', {});\n\n// Assign Reader role to a user at subscription scope\nconst readerAssignment = new RoleAssignment(this, 'reader-assignment', {\n  name: 'reader-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7', // Reader\n  principalId: '00000000-0000-0000-0000-000000000000', // User Object ID from Azure AD\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000',\n  principalType: 'User',\n  description: 'Grants read access to all resources in the subscription',\n});\n```\n\n### Assign Role to Service Principal\n\n```typescript\nconst contributorAssignment = new RoleAssignment(this, 'sp-contributor', {\n  name: 'sp-contributor-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c', // Contributor\n  principalId: servicePrincipal.objectId,\n  scope: resourceGroup.id,\n  principalType: 'ServicePrincipal',\n  description: 'Grants contributor access to the application service principal',\n});\n```\n\n## Advanced Usage\n\n### Conditional Assignment with ABAC\n\nAttribute-Based Access Control (ABAC) allows you to add conditions to role assignments:\n\n```typescript\n// Limit access to specific storage containers\nconst conditionalAssignment = new RoleAssignment(this, 'conditional-access', {\n  name: 'conditional-storage-access',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe', // Storage Blob Data Contributor\n  principalId: user.objectId,\n  scope: storageAccount.id,\n  principalType: 'User',\n  condition: \"@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'logs'\",\n  conditionVersion: '2.0',\n  description: 'Grants blob data contributor access only to the logs container',\n});\n```\n\n### Assign Custom Role Definition\n\n```typescript\nimport { RoleDefinition } from '@microsoft/terraform-cdk-constructs/azure-roledefinition';\n\n// Create a custom role definition\nconst customRole = new RoleDefinition(this, 'custom-role', {\n  name: 'vm-operator',\n  roleName: 'Virtual Machine Operator',\n  description: 'Can start, stop, and restart virtual machines',\n  permissions: [{\n    actions: [\n      'Microsoft.Compute/virtualMachines/start/action',\n      'Microsoft.Compute/virtualMachines/restart/action',\n      'Microsoft.Compute/virtualMachines/powerOff/action',\n      'Microsoft.Compute/virtualMachines/read',\n    ],\n    notActions: [],\n    dataActions: [],\n    notDataActions: [],\n  }],\n  assignableScopes: ['/subscriptions/00000000-0000-0000-0000-000000000000'],\n});\n\n// Assign the custom role\nnew RoleAssignment(this, 'custom-role-assignment', {\n  name: 'vm-operator-assignment',\n  roleDefinitionId: customRole.id,\n  principalId: '00000000-0000-0000-0000-000000000000',\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000',\n  principalType: 'User',\n  description: 'Assigns custom VM Operator role to user',\n});\n```\n\n### Group Assignment with Delegated Managed Identity\n\n```typescript\n// Assign role to a group using a delegated managed identity\nconst groupAssignment = new RoleAssignment(this, 'group-assignment', {\n  name: 'group-with-delegated-identity',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7', // Reader\n  principalId: group.objectId,\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000',\n  principalType: 'Group',\n  delegatedManagedIdentityResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity',\n  description: 'Group assignment using delegated managed identity',\n});\n```\n\n### Resource Group Scoped Assignment\n\n```typescript\nconst rgAssignment = new RoleAssignment(this, 'rg-contributor', {\n  name: 'rg-contributor-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c', // Contributor\n  principalId: '00000000-0000-0000-0000-000000000000',\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-resource-group',\n  principalType: 'User',\n  description: 'Grants contributor access only to this resource group',\n});\n```\n\n### Individual Resource Scoped Assignment\n\n```typescript\nconst resourceAssignment = new RoleAssignment(this, 'storage-contributor', {\n  name: 'storage-contributor-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe', // Storage Blob Data Contributor\n  principalId: managedIdentity.principalId,\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/mystorageaccount',\n  principalType: 'ServicePrincipal',\n  description: 'Grants blob data contributor access to this specific storage account',\n});\n```\n\n## Properties\n\n### Required Properties\n\n| Property | Type | Description |\n|----------|------|-------------|\n| `roleDefinitionId` | string | The role definition ID to assign (built-in or custom role) |\n| `principalId` | string | The Object ID of the principal (user, group, service principal, managed identity) |\n| `scope` | string | The scope at which the role is assigned (subscription, resource group, or resource) |\n\n### Optional Properties\n\n| Property | Type | Default | Description |\n|----------|------|---------|-------------|\n| `name` | string | Auto-generated | The name of the role assignment resource |\n| `principalType` | string | undefined | Type of principal: User, Group, ServicePrincipal, ForeignGroup, Device |\n| `description` | string | undefined | Description of why the assignment was made |\n| `condition` | string | undefined | ABAC condition expression to limit access |\n| `conditionVersion` | string | undefined | Version of condition syntax (e.g., \"2.0\") |\n| `delegatedManagedIdentityResourceId` | string | undefined | Resource ID of delegated managed identity (for group assignments) |\n| `apiVersion` | string | \"2022-04-01\" | Explicit API version to use |\n| `tags` | object | {} | Tags to apply to the role assignment |\n| `ignoreChanges` | string[] | [] | Properties to ignore during updates |\n\n## Outputs\n\nThe [`RoleAssignment`](lib/role-assignment.ts:188) construct provides the following outputs:\n\n| Output | Type | Description |\n|--------|------|-------------|\n| `id` | string | The resource ID of the role assignment |\n| `name` | string | The name of the role assignment |\n| `resourceId` | string | Alias for the id property |\n| `roleDefinitionId` | string | The role definition ID that was assigned |\n| `principalId` | string | The principal ID that was granted the role |\n| `assignmentScope` | string | The scope at which the role was assigned |\n| `principalType` | string \\| undefined | The type of principal (if specified) |\n\n## API Versions\n\n### Supported Versions\n\n| Version | Support Level | Release Date | Notes |\n|---------|---------------|--------------|-------|\n| [2022-04-01](lib/role-assignment-schemas.ts:145) | Active (Latest) | 2022-04-01 | Full support for ABAC conditional assignments and delegated managed identities |\n\n### Version Selection\n\n```typescript\n// Use latest version (default)\nnew RoleAssignment(this, 'assignment', {\n  roleDefinitionId: '...',\n  principalId: '...',\n  scope: '...',\n});\n\n// Pin to specific version\nnew RoleAssignment(this, 'assignment', {\n  roleDefinitionId: '...',\n  principalId: '...',\n  scope: '...',\n  apiVersion: '2022-04-01',\n});\n```\n\n## Principal Types\n\n### User\nAn Azure AD user account.\n\n```typescript\nprincipalType: 'User'\n```\n\n### Group\nAn Azure AD group. Can be used with delegated managed identity.\n\n```typescript\nprincipalType: 'Group'\n```\n\n### ServicePrincipal\nAn application or service principal (including managed identities).\n\n```typescript\nprincipalType: 'ServicePrincipal'\n```\n\n### ForeignGroup\nA group from an external directory (B2B collaboration).\n\n```typescript\nprincipalType: 'ForeignGroup'\n```\n\n### Device\nA device identity from Azure AD.\n\n```typescript\nprincipalType: 'Device'\n```\n\n## Built-in Roles\n\n### Common Built-in Role Definition IDs\n\n| Role Name | Role ID | Description |\n|-----------|---------|-------------|\n| Owner | `8e3af657-a8ff-443c-a75c-2fe8c4bcb635` | Full access to all resources including the ability to assign roles |\n| Contributor | `b24988ac-6180-42a0-ab88-20f7382dd24c` | Full access to all resources but cannot assign roles |\n| Reader | `acdd72a7-3385-48ef-bd42-f606fba81ae7` | View all resources but cannot make changes |\n| User Access Administrator | `18d7d88d-d35e-4fb5-a5c3-7773c20a72d9` | Manage user access to Azure resources |\n| Storage Blob Data Contributor | `ba92f5b4-2d11-453d-a403-e96b0029c9fe` | Read, write, and delete Azure Storage containers and blobs |\n| Storage Blob Data Reader | `2a2b9908-6ea1-4ae2-8e65-a410df84e7d1` | Read Azure Storage containers and blobs |\n| Key Vault Secrets User | `4633458b-17de-408a-b874-0445c86b69e6` | Read secret contents from Key Vault |\n| Virtual Machine Contributor | `9980e02c-c2be-4d73-94e8-173b1dc7cf3c` | Manage virtual machines but not the virtual network or storage account they're connected to |\n\nFor a complete list, see [Azure Built-in Roles](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles).\n\n## Best Practices\n\n### 1. Principle of Least Privilege\n\nAlways assign the minimum permissions required:\n\n```typescript\n// ❌ Bad: Overly permissive\nroleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635' // Owner\n\n// ✅ Good: Specific permissions\nroleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7' // Reader\n```\n\n### 2. Specific Scopes\n\nAssign roles at the narrowest scope possible:\n\n```typescript\n// ❌ Bad: Subscription-wide access when not needed\nscope: '/subscriptions/00000000-0000-0000-0000-000000000000'\n\n// ✅ Good: Resource group or resource-specific\nscope: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg'\n```\n\n### 3. Always Specify Principal Type\n\nImproves performance and clarity:\n\n```typescript\n// ✅ Good\nnew RoleAssignment(this, 'assignment', {\n  // ...\n  principalType: 'ServicePrincipal',  // Explicit type\n});\n```\n\n### 4. Use Conditional Access When Appropriate\n\nLimit access further with ABAC conditions:\n\n```typescript\nnew RoleAssignment(this, 'conditional', {\n  // ...\n  condition: \"@Resource[Microsoft.Storage/storageAccounts:name] StringStartsWith 'prod'\",\n  conditionVersion: '2.0',\n});\n```\n\n### 5. Document Assignments\n\nUse descriptions to explain why assignments exist:\n\n```typescript\nnew RoleAssignment(this, 'assignment', {\n  // ...\n  description: 'Grants read access to monitoring team for incident response. Approved by Security-12345.',\n});\n```\n\n### 6. Prefer Custom Roles\n\nCreate custom roles for specific needs instead of using broad built-in roles:\n\n```typescript\n// Create custom role with exact permissions needed\nconst customRole = new RoleDefinition(this, 'custom', {\n  roleName: 'Specific Task Operator',\n  permissions: [/* only required actions */],\n  assignableScopes: [/* specific scopes */],\n});\n```\n\n### 7. Use Managed Identities\n\nPrefer managed identities over service principals:\n\n```typescript\n// ✅ Good: System-assigned managed identity\nprincipalId: virtualMachine.identity.principalId,\nprincipalType: 'ServicePrincipal',\n```\n\n### 8. Regular Audits\n\nPeriodically review and remove unnecessary role assignments. Use tags to track:\n\n```typescript\nnew RoleAssignment(this, 'assignment', {\n  // ...\n  tags: {\n    owner: 'team-name',\n    purpose: 'data-processing',\n    reviewDate: '2024-12-31',\n  },\n});\n```\n\n## Examples\n\n### Example 1: Multi-Region Monitoring Setup\n\n```typescript\nconst regions = ['eastus', 'westus', 'northeurope'];\n\nregions.forEach(region => {\n  new RoleAssignment(this, `monitoring-${region}`, {\n    name: `monitoring-reader-${region}`,\n    roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/43d0d8ad-25c7-4714-9337-8ba259a9fe05', // Monitoring Reader\n    principalId: monitoringServicePrincipal.objectId,\n    scope: `/subscriptions/${subscriptionId}/resourceGroups/rg-${region}`,\n    principalType: 'ServicePrincipal',\n    description: `Monitoring access for ${region} resources`,\n    tags: {\n      region,\n      purpose: 'monitoring',\n    },\n  });\n});\n```\n\n### Example 2: Separation of Duties\n\n```typescript\n// Development team: Contributor at resource group level\nnew RoleAssignment(this, 'dev-team-contributor', {\n  name: 'dev-team-rg-contributor',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c',\n  principalId: devTeamGroup.objectId,\n  scope: devResourceGroup.id,\n  principalType: 'Group',\n  description: 'Development team can manage resources in dev environment',\n});\n\n// Operations team: Reader at subscription, Contributor at production RG\nnew RoleAssignment(this, 'ops-team-reader', {\n  name: 'ops-team-subscription-reader',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7',\n  principalId: opsTeamGroup.objectId,\n  scope: `/subscriptions/${subscriptionId}`,\n  principalType: 'Group',\n  description: 'Operations team can view all resources',\n});\n\nnew RoleAssignment(this, 'ops-team-contributor', {\n  name: 'ops-team-prod-contributor',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c',\n  principalId: opsTeamGroup.objectId,\n  scope: prodResourceGroup.id,\n  principalType: 'Group',\n  description: 'Operations team can manage production resources',\n});\n```\n\n### Example 3: Temporary Access\n\n```typescript\n// Grant temporary elevated access (remember to remove after use)\nnew RoleAssignment(this, 'temp-access', {\n  name: 'temp-contributor-access',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c',\n  principalId: contractor.objectId,\n  scope: temporaryResourceGroup.id,\n  principalType: 'User',\n  description: 'Temporary access for migration project. Remove after 2024-06-30.',\n  tags: {\n    temporary: 'true',\n    expiryDate: '2024-06-30',\n    ticketNumber: 'PROJ-12345',\n  },\n});\n```\n\n## Relationship with Role Definition\n\nRole assignments and role definitions work together to implement Azure RBAC:\n\n- **Role Definition**: Defines WHAT permissions are granted (actions, dataActions, etc.)\n- **Role Assignment**: Defines WHO gets those permissions and WHERE (scope)\n\n```typescript\nimport { RoleDefinition } from '@microsoft/terraform-cdk-constructs/azure-roledefinition';\nimport { RoleAssignment } from '@microsoft/terraform-cdk-constructs/azure-roleassignment';\n\n// Step 1: Define what permissions are needed\nconst customRole = new RoleDefinition(this, 'data-processor-role', {\n  name: 'data-processor',\n  roleName: 'Data Processor',\n  permissions: [{\n    actions: ['Microsoft.Storage/storageAccounts/blobServices/containers/read'],\n    dataActions: [\n      'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read',\n      'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write',\n    ],\n  }],\n  assignableScopes: ['/subscriptions/00000000-0000-0000-0000-000000000000'],\n});\n\n// Step 2: Assign those permissions to a principal\nnew RoleAssignment(this, 'processor-assignment', {\n  name: 'data-processor-assignment',\n  roleDefinitionId: customRole.id,\n  principalId: dataProcessorApp.principalId,\n  scope: storageAccount.id,\n  principalType: 'ServicePrincipal',\n  description: 'Grants data processing application access to storage',\n});\n```\n\n## Additional Resources\n\n- [Azure RBAC Documentation](https://docs.microsoft.com/azure/role-based-access-control/)\n- [Azure Built-in Roles](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles)\n- [Azure ABAC Conditions](https://docs.microsoft.com/azure/role-based-access-control/conditions-overview)\n- [Best Practices for Azure RBAC](https://docs.microsoft.com/azure/role-based-access-control/best-practices)\n- [Azure Role Assignments REST API](https://docs.microsoft.com/rest/api/authorization/role-assignments)\n- [Managed Identities for Azure Resources](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/)\n\n## License\n\nThis module is part of the terraform-cdk-constructs project and is licensed under the MIT License."
+        "markdown": "# Azure Role Assignment Construct\n\nThis module provides a CDK construct for managing Azure Role Assignments using the AZAPI provider. Role assignments grant specific permissions (roles) to security principals (users, groups, service principals, managed identities) at a particular scope (management group, subscription, resource group, or resource).\n\n## Table of Contents\n\n- [Features](#features)\n- [Installation](#installation)\n- [Basic Usage](#basic-usage)\n- [Advanced Usage](#advanced-usage)\n- [Properties](#properties)\n- [Outputs](#outputs)\n- [API Versions](#api-versions)\n- [Principal Types](#principal-types)\n- [Built-in Roles](#built-in-roles)\n- [Best Practices](#best-practices)\n- [Examples](#examples)\n\n## Features\n\n- **Version-Aware Resource Management**: Automatic API version resolution with support for explicit version pinning\n- **Schema-Driven Validation**: Built-in property validation with comprehensive error messages\n- **Principal Types**: Support for User, Group, ServicePrincipal, ForeignGroup, and Device principals\n- **Conditional Access (ABAC)**: Attribute-Based Access Control with condition expressions\n- **Flexible Scoping**: Assign roles at management group, subscription, resource group, or individual resource scope\n- **Delegated Managed Identity**: Support for delegated identity scenarios with group assignments\n- **Built-in and Custom Roles**: Works with both Azure built-in roles and custom role definitions\n- **JSII Compliance**: Full support for multi-language bindings\n\n## Why Use AZAPI Provider?\n\nThe AZAPI provider offers several advantages for managing role assignments:\n\n1. **Latest API Support**: Access to the newest Azure features without waiting for provider updates\n2. **Consistent Interface**: Unified approach across all Azure resources\n3. **Version Flexibility**: Pin to specific API versions or use latest automatically\n4. **Full Feature Coverage**: Support for all Azure properties including preview features\n5. **Type Safety**: Strong typing and validation for all resource properties\n\n## Installation\n\nThis construct is part of the terraform-cdk-constructs library:\n\n```bash\nnpm install @microsoft/terraform-cdk-constructs\n```\n\n## Basic Usage\n\n### Assign Built-in Reader Role\n\n```typescript\nimport { RoleAssignment } from '@microsoft/terraform-cdk-constructs/azure-roleassignment';\nimport { AzapiProvider } from '@microsoft/terraform-cdk-constructs/core-azure';\n\n// Configure the AZAPI provider\nnew AzapiProvider(this, 'azapi', {});\n\n// Assign Reader role to a user at subscription scope\nconst readerAssignment = new RoleAssignment(this, 'reader-assignment', {\n  name: 'reader-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7', // Reader\n  principalId: '00000000-0000-0000-0000-000000000000', // User Object ID from Azure AD\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000',\n  principalType: 'User',\n  description: 'Grants read access to all resources in the subscription',\n});\n```\n\n### Assign Role to Service Principal\n\n```typescript\nconst contributorAssignment = new RoleAssignment(this, 'sp-contributor', {\n  name: 'sp-contributor-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c', // Contributor\n  principalId: servicePrincipal.objectId,\n  scope: resourceGroup.id,\n  principalType: 'ServicePrincipal',\n  description: 'Grants contributor access to the application service principal',\n});\n```\n\n## Advanced Usage\n\n### Conditional Assignment with ABAC\n\nAttribute-Based Access Control (ABAC) allows you to add conditions to role assignments:\n\n```typescript\n// Limit access to specific storage containers\nconst conditionalAssignment = new RoleAssignment(this, 'conditional-access', {\n  name: 'conditional-storage-access',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe', // Storage Blob Data Contributor\n  principalId: user.objectId,\n  scope: storageAccount.id,\n  principalType: 'User',\n  condition: \"@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'logs'\",\n  conditionVersion: '2.0',\n  description: 'Grants blob data contributor access only to the logs container',\n});\n```\n\n### Assign Custom Role Definition\n\n```typescript\nimport { RoleDefinition } from '@microsoft/terraform-cdk-constructs/azure-roledefinition';\n\n// Create a custom role definition\nconst customRole = new RoleDefinition(this, 'custom-role', {\n  name: 'vm-operator',\n  roleName: 'Virtual Machine Operator',\n  description: 'Can start, stop, and restart virtual machines',\n  permissions: [{\n    actions: [\n      'Microsoft.Compute/virtualMachines/start/action',\n      'Microsoft.Compute/virtualMachines/restart/action',\n      'Microsoft.Compute/virtualMachines/powerOff/action',\n      'Microsoft.Compute/virtualMachines/read',\n    ],\n    notActions: [],\n    dataActions: [],\n    notDataActions: [],\n  }],\n  assignableScopes: ['/subscriptions/00000000-0000-0000-0000-000000000000'],\n});\n\n// Assign the custom role\nnew RoleAssignment(this, 'custom-role-assignment', {\n  name: 'vm-operator-assignment',\n  roleDefinitionId: customRole.id,\n  principalId: '00000000-0000-0000-0000-000000000000',\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000',\n  principalType: 'User',\n  description: 'Assigns custom VM Operator role to user',\n});\n```\n\n### Group Assignment with Delegated Managed Identity\n\n```typescript\n// Assign role to a group using a delegated managed identity\nconst groupAssignment = new RoleAssignment(this, 'group-assignment', {\n  name: 'group-with-delegated-identity',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7', // Reader\n  principalId: group.objectId,\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000',\n  principalType: 'Group',\n  delegatedManagedIdentityResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/identity',\n  description: 'Group assignment using delegated managed identity',\n});\n```\n\n### Management Group Scoped Assignment\n\n```typescript\n// Assign a role at management group scope for organization-wide access\nconst mgAssignment = new RoleAssignment(this, 'mg-reader', {\n  name: 'mg-reader-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7', // Reader\n  principalId: '00000000-0000-0000-0000-000000000000',\n  scope: '/providers/Microsoft.Management/managementGroups/my-mg',\n  principalType: 'Group',\n  description: 'Grants read access across the entire management group hierarchy',\n});\n```\n\n### Resource Group Scoped Assignment\n\n```typescript\nconst rgAssignment = new RoleAssignment(this, 'rg-contributor', {\n  name: 'rg-contributor-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c', // Contributor\n  principalId: '00000000-0000-0000-0000-000000000000',\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-resource-group',\n  principalType: 'User',\n  description: 'Grants contributor access only to this resource group',\n});\n```\n\n### Individual Resource Scoped Assignment\n\n```typescript\nconst resourceAssignment = new RoleAssignment(this, 'storage-contributor', {\n  name: 'storage-contributor-assignment',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe', // Storage Blob Data Contributor\n  principalId: managedIdentity.principalId,\n  scope: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/mystorageaccount',\n  principalType: 'ServicePrincipal',\n  description: 'Grants blob data contributor access to this specific storage account',\n});\n```\n\n## Properties\n\n### Required Properties\n\n| Property | Type | Description |\n|----------|------|-------------|\n| `roleDefinitionId` | string | The role definition ID to assign (built-in or custom role) |\n| `principalId` | string | The Object ID of the principal (user, group, service principal, managed identity) |\n| `scope` | string | The scope at which the role is assigned (management group, subscription, resource group, or resource) |\n\n### Optional Properties\n\n| Property | Type | Default | Description |\n|----------|------|---------|-------------|\n| `name` | string | Auto-generated | The name of the role assignment resource |\n| `principalType` | string | undefined | Type of principal: User, Group, ServicePrincipal, ForeignGroup, Device |\n| `description` | string | undefined | Description of why the assignment was made |\n| `condition` | string | undefined | ABAC condition expression to limit access |\n| `conditionVersion` | string | undefined | Version of condition syntax (e.g., \"2.0\") |\n| `delegatedManagedIdentityResourceId` | string | undefined | Resource ID of delegated managed identity (for group assignments) |\n| `apiVersion` | string | \"2022-04-01\" | Explicit API version to use |\n| `tags` | object | {} | Tags to apply to the role assignment |\n| `ignoreChanges` | string[] | [] | Properties to ignore during updates |\n\n## Outputs\n\nThe [`RoleAssignment`](lib/role-assignment.ts:188) construct provides the following outputs:\n\n| Output | Type | Description |\n|--------|------|-------------|\n| `id` | string | The resource ID of the role assignment |\n| `name` | string | The name of the role assignment |\n| `resourceId` | string | Alias for the id property |\n| `roleDefinitionId` | string | The role definition ID that was assigned |\n| `principalId` | string | The principal ID that was granted the role |\n| `assignmentScope` | string | The scope at which the role was assigned |\n| `principalType` | string \\| undefined | The type of principal (if specified) |\n\n## API Versions\n\n### Supported Versions\n\n| Version | Support Level | Release Date | Notes |\n|---------|---------------|--------------|-------|\n| [2022-04-01](lib/role-assignment-schemas.ts:145) | Active (Latest) | 2022-04-01 | Full support for ABAC conditional assignments and delegated managed identities |\n\n### Version Selection\n\n```typescript\n// Use latest version (default)\nnew RoleAssignment(this, 'assignment', {\n  roleDefinitionId: '...',\n  principalId: '...',\n  scope: '...',\n});\n\n// Pin to specific version\nnew RoleAssignment(this, 'assignment', {\n  roleDefinitionId: '...',\n  principalId: '...',\n  scope: '...',\n  apiVersion: '2022-04-01',\n});\n```\n\n## Principal Types\n\n### User\nAn Azure AD user account.\n\n```typescript\nprincipalType: 'User'\n```\n\n### Group\nAn Azure AD group. Can be used with delegated managed identity.\n\n```typescript\nprincipalType: 'Group'\n```\n\n### ServicePrincipal\nAn application or service principal (including managed identities).\n\n```typescript\nprincipalType: 'ServicePrincipal'\n```\n\n### ForeignGroup\nA group from an external directory (B2B collaboration).\n\n```typescript\nprincipalType: 'ForeignGroup'\n```\n\n### Device\nA device identity from Azure AD.\n\n```typescript\nprincipalType: 'Device'\n```\n\n## Built-in Roles\n\n### Common Built-in Role Definition IDs\n\n| Role Name | Role ID | Description |\n|-----------|---------|-------------|\n| Owner | `8e3af657-a8ff-443c-a75c-2fe8c4bcb635` | Full access to all resources including the ability to assign roles |\n| Contributor | `b24988ac-6180-42a0-ab88-20f7382dd24c` | Full access to all resources but cannot assign roles |\n| Reader | `acdd72a7-3385-48ef-bd42-f606fba81ae7` | View all resources but cannot make changes |\n| User Access Administrator | `18d7d88d-d35e-4fb5-a5c3-7773c20a72d9` | Manage user access to Azure resources |\n| Storage Blob Data Contributor | `ba92f5b4-2d11-453d-a403-e96b0029c9fe` | Read, write, and delete Azure Storage containers and blobs |\n| Storage Blob Data Reader | `2a2b9908-6ea1-4ae2-8e65-a410df84e7d1` | Read Azure Storage containers and blobs |\n| Key Vault Secrets User | `4633458b-17de-408a-b874-0445c86b69e6` | Read secret contents from Key Vault |\n| Virtual Machine Contributor | `9980e02c-c2be-4d73-94e8-173b1dc7cf3c` | Manage virtual machines but not the virtual network or storage account they're connected to |\n\nFor a complete list, see [Azure Built-in Roles](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles).\n\n## Best Practices\n\n### 1. Principle of Least Privilege\n\nAlways assign the minimum permissions required:\n\n```typescript\n// ❌ Bad: Overly permissive\nroleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635' // Owner\n\n// ✅ Good: Specific permissions\nroleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7' // Reader\n```\n\n### 2. Specific Scopes\n\nAssign roles at the narrowest scope possible:\n\n```typescript\n// ❌ Bad: Management group-wide access when subscription scope is sufficient\nscope: '/providers/Microsoft.Management/managementGroups/my-mg'\n\n// ❌ Bad: Subscription-wide access when not needed\nscope: '/subscriptions/00000000-0000-0000-0000-000000000000'\n\n// ✅ Good: Resource group or resource-specific\nscope: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg'\n```\n\n### 3. Always Specify Principal Type\n\nImproves performance and clarity:\n\n```typescript\n// ✅ Good\nnew RoleAssignment(this, 'assignment', {\n  // ...\n  principalType: 'ServicePrincipal',  // Explicit type\n});\n```\n\n### 4. Use Conditional Access When Appropriate\n\nLimit access further with ABAC conditions:\n\n```typescript\nnew RoleAssignment(this, 'conditional', {\n  // ...\n  condition: \"@Resource[Microsoft.Storage/storageAccounts:name] StringStartsWith 'prod'\",\n  conditionVersion: '2.0',\n});\n```\n\n### 5. Document Assignments\n\nUse descriptions to explain why assignments exist:\n\n```typescript\nnew RoleAssignment(this, 'assignment', {\n  // ...\n  description: 'Grants read access to monitoring team for incident response. Approved by Security-12345.',\n});\n```\n\n### 6. Prefer Custom Roles\n\nCreate custom roles for specific needs instead of using broad built-in roles:\n\n```typescript\n// Create custom role with exact permissions needed\nconst customRole = new RoleDefinition(this, 'custom', {\n  roleName: 'Specific Task Operator',\n  permissions: [/* only required actions */],\n  assignableScopes: [/* specific scopes */],\n});\n```\n\n### 7. Use Managed Identities\n\nPrefer managed identities over service principals:\n\n```typescript\n// ✅ Good: System-assigned managed identity\nprincipalId: virtualMachine.identity.principalId,\nprincipalType: 'ServicePrincipal',\n```\n\n### 8. Regular Audits\n\nPeriodically review and remove unnecessary role assignments. Use tags to track:\n\n```typescript\nnew RoleAssignment(this, 'assignment', {\n  // ...\n  tags: {\n    owner: 'team-name',\n    purpose: 'data-processing',\n    reviewDate: '2024-12-31',\n  },\n});\n```\n\n## Examples\n\n### Example 1: Management Group Level Access Control\n\n```typescript\n// Grant organization-wide read access to security team at management group level\nconst securityReaderAssignment = new RoleAssignment(this, 'security-mg-reader', {\n  name: 'security-org-reader',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7', // Reader\n  principalId: securityTeamGroup.objectId,\n  scope: '/providers/Microsoft.Management/managementGroups/root-mg',\n  principalType: 'Group',\n  description: 'Grants security team read access across all subscriptions and resources in the organization',\n  tags: {\n    team: 'security',\n    purpose: 'compliance-monitoring',\n  },\n});\n\n// Grant User Access Administrator at management group for identity management team\nconst identityMgmtAssignment = new RoleAssignment(this, 'identity-mg-uaa', {\n  name: 'identity-user-access-admin',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/18d7d88d-d35e-4fb5-a5c3-7773c20a72d9', // User Access Administrator\n  principalId: identityTeamGroup.objectId,\n  scope: '/providers/Microsoft.Management/managementGroups/root-mg',\n  principalType: 'Group',\n  description: 'Grants identity team ability to manage role assignments organization-wide',\n});\n```\n\n### Example 2: Multi-Region Monitoring Setup\n\n```typescript\nconst regions = ['eastus', 'westus', 'northeurope'];\n\nregions.forEach(region => {\n  new RoleAssignment(this, `monitoring-${region}`, {\n    name: `monitoring-reader-${region}`,\n    roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/43d0d8ad-25c7-4714-9337-8ba259a9fe05', // Monitoring Reader\n    principalId: monitoringServicePrincipal.objectId,\n    scope: `/subscriptions/${subscriptionId}/resourceGroups/rg-${region}`,\n    principalType: 'ServicePrincipal',\n    description: `Monitoring access for ${region} resources`,\n    tags: {\n      region,\n      purpose: 'monitoring',\n    },\n  });\n});\n```\n\n### Example 2: Separation of Duties\n\n```typescript\n// Development team: Contributor at resource group level\nnew RoleAssignment(this, 'dev-team-contributor', {\n  name: 'dev-team-rg-contributor',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c',\n  principalId: devTeamGroup.objectId,\n  scope: devResourceGroup.id,\n  principalType: 'Group',\n  description: 'Development team can manage resources in dev environment',\n});\n\n// Operations team: Reader at subscription, Contributor at production RG\nnew RoleAssignment(this, 'ops-team-reader', {\n  name: 'ops-team-subscription-reader',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7',\n  principalId: opsTeamGroup.objectId,\n  scope: `/subscriptions/${subscriptionId}`,\n  principalType: 'Group',\n  description: 'Operations team can view all resources',\n});\n\nnew RoleAssignment(this, 'ops-team-contributor', {\n  name: 'ops-team-prod-contributor',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c',\n  principalId: opsTeamGroup.objectId,\n  scope: prodResourceGroup.id,\n  principalType: 'Group',\n  description: 'Operations team can manage production resources',\n});\n```\n\n### Example 3: Temporary Access\n\n```typescript\n// Grant temporary elevated access (remember to remove after use)\nnew RoleAssignment(this, 'temp-access', {\n  name: 'temp-contributor-access',\n  roleDefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c',\n  principalId: contractor.objectId,\n  scope: temporaryResourceGroup.id,\n  principalType: 'User',\n  description: 'Temporary access for migration project. Remove after 2024-06-30.',\n  tags: {\n    temporary: 'true',\n    expiryDate: '2024-06-30',\n    ticketNumber: 'PROJ-12345',\n  },\n});\n```\n\n## Relationship with Role Definition\n\nRole assignments and role definitions work together to implement Azure RBAC:\n\n- **Role Definition**: Defines WHAT permissions are granted (actions, dataActions, etc.)\n- **Role Assignment**: Defines WHO gets those permissions and WHERE (scope)\n\n```typescript\nimport { RoleDefinition } from '@microsoft/terraform-cdk-constructs/azure-roledefinition';\nimport { RoleAssignment } from '@microsoft/terraform-cdk-constructs/azure-roleassignment';\n\n// Step 1: Define what permissions are needed\nconst customRole = new RoleDefinition(this, 'data-processor-role', {\n  name: 'data-processor',\n  roleName: 'Data Processor',\n  permissions: [{\n    actions: ['Microsoft.Storage/storageAccounts/blobServices/containers/read'],\n    dataActions: [\n      'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read',\n      'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write',\n    ],\n  }],\n  assignableScopes: ['/subscriptions/00000000-0000-0000-0000-000000000000'],\n});\n\n// Step 2: Assign those permissions to a principal\nnew RoleAssignment(this, 'processor-assignment', {\n  name: 'data-processor-assignment',\n  roleDefinitionId: customRole.id,\n  principalId: dataProcessorApp.principalId,\n  scope: storageAccount.id,\n  principalType: 'ServicePrincipal',\n  description: 'Grants data processing application access to storage',\n});\n```\n\n## Additional Resources\n\n- [Azure RBAC Documentation](https://docs.microsoft.com/azure/role-based-access-control/)\n- [Azure Built-in Roles](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles)\n- [Azure ABAC Conditions](https://docs.microsoft.com/azure/role-based-access-control/conditions-overview)\n- [Best Practices for Azure RBAC](https://docs.microsoft.com/azure/role-based-access-control/best-practices)\n- [Azure Role Assignments REST API](https://docs.microsoft.com/rest/api/authorization/role-assignments)\n- [Managed Identities for Azure Resources](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/)\n\n## License\n\nThis module is part of the terraform-cdk-constructs project and is licensed under the MIT License."
       },
       "symbolId": "src/azure-roleassignment/index:"
     },
@@ -271,7 +271,7 @@
         "line": 52
       },
       "readme": {
-        "markdown": "# Azure Role Definition Construct\n\nThis module provides a CDK for Terraform (CDKTF) construct for managing Azure RBAC Role Definitions using the AZAPI provider. Role definitions define custom roles with specific permissions that can be assigned to users, groups, or service principals through role assignments.\n\n## Features\n\n- **Version-Aware Schema Management**: Automatic handling of API version resolution and schema validation\n- **Custom RBAC Roles**: Define custom roles with granular permissions\n- **Control Plane Actions**: Specify allowed and denied management operations\n- **Data Plane Actions**: Define permissions for data operations within resources\n- **Flexible Scoping**: Assign roles at subscription, resource group, or management group level\n- **Type Safety**: Full TypeScript support with comprehensive type definitions\n- **JSII Compliance**: Multi-language support (TypeScript, Python, Java, C#, Go)\n\n## AZAPI Provider Benefits\n\nThis construct uses the AZAPI provider, which offers several advantages:\n\n- **Day-0 Support**: Access to new Azure features immediately upon release\n- **Consistent API**: Direct mapping to Azure REST API structure\n- **Reduced Complexity**: No need to wait for provider updates\n- **Better Compatibility**: Works seamlessly with the latest Azure features\n\n## Installation\n\n```bash\nnpm install @cdktf/terraform-cdk-constructs\n```\n\n## Supported API Versions\n\n| API Version | Support Level | Release Date | Status |\n|-------------|---------------|--------------|--------|\n| 2022-04-01  | Active        | 2022-04-01   | Latest |\n\n## Basic Usage\n\n### Create a Simple Read-Only Role\n\n```typescript\nimport { RoleDefinition } from \"@cdktf/terraform-cdk-constructs/azure-roledefinition\";\n\nconst vmReaderRole = new RoleDefinition(this, \"vm-reader\", {\n  name: \"vm-reader-role\",\n  roleName: \"Virtual Machine Reader\",\n  description: \"Can view virtual machines and their properties\",\n  permissions: [\n    {\n      actions: [\n        \"Microsoft.Compute/virtualMachines/read\",\n        \"Microsoft.Compute/virtualMachines/instanceView/read\",\n        \"Microsoft.Network/networkInterfaces/read\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n```\n\n## Advanced Features\n\n### Role with Data Plane Permissions\n\nCreate a role with both control plane and data plane permissions for comprehensive access management:\n\n```typescript\nconst storageOperator = new RoleDefinition(this, \"storage-operator\", {\n  name: \"storage-operator-role\",\n  roleName: \"Storage Operator\",\n  description: \"Can manage storage accounts and read/write blob data\",\n  permissions: [\n    {\n      // Control plane actions - manage storage accounts\n      actions: [\n        \"Microsoft.Storage/storageAccounts/read\",\n        \"Microsoft.Storage/storageAccounts/write\",\n        \"Microsoft.Storage/storageAccounts/listkeys/action\"\n      ],\n      // Explicitly deny delete operations\n      notActions: [\n        \"Microsoft.Storage/storageAccounts/delete\"\n      ],\n      // Data plane actions - read and write blobs\n      dataActions: [\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\",\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write\"\n      ],\n      // Explicitly deny delete operations on data plane\n      notDataActions: [\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n```\n\n### Multiple Assignable Scopes\n\nDefine a role that can be assigned at multiple levels:\n\n```typescript\nconst multiScopeRole = new RoleDefinition(this, \"multi-scope\", {\n  name: \"multi-scope-role\",\n  roleName: \"Multi-Scope Operator\",\n  description: \"Can be assigned at subscription, resource group, or management group level\",\n  permissions: [\n    {\n      actions: [\n        \"Microsoft.Resources/subscriptions/read\",\n        \"Microsoft.Resources/subscriptions/resourceGroups/read\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n    \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1\",\n    \"/providers/Microsoft.Management/managementGroups/mg1\"\n  ]\n});\n```\n\n### Complex Permission Combinations\n\nCreate sophisticated roles with multiple permission objects:\n\n```typescript\nconst complexRole = new RoleDefinition(this, \"complex-role\", {\n  name: \"complex-role\",\n  roleName: \"Complex Operator Role\",\n  description: \"Role with multiple permission sets\",\n  permissions: [\n    {\n      // Compute permissions\n      actions: [\"Microsoft.Compute/virtualMachines/read\"],\n      notActions: []\n    },\n    {\n      // Storage permissions\n      actions: [\"Microsoft.Storage/storageAccounts/read\"],\n      dataActions: [\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\"\n      ]\n    },\n    {\n      // Network permissions\n      actions: [\n        \"Microsoft.Network/virtualNetworks/read\",\n        \"Microsoft.Network/networkInterfaces/read\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n```\n\n## Properties\n\n### Required Properties\n\n| Property | Type | Description |\n|----------|------|-------------|\n| `roleName` | string | Display name of the role (1-128 characters) |\n| `permissions` | RoleDefinitionPermission[] | Array of permission objects defining role capabilities |\n| `assignableScopes` | string[] | Scopes where the role can be assigned |\n\n### Optional Properties\n\n| Property | Type | Default | Description |\n|----------|------|---------|-------------|\n| `name` | string | Auto-generated | Resource name for the role definition |\n| `description` | string | - | Detailed description of the role (max 1024 characters) |\n| `type` | string | \"CustomRole\" | Role type (CustomRole or BuiltInRole) |\n| `apiVersion` | string | \"2022-04-01\" | Azure API version to use |\n| `ignoreChanges` | string[] | - | Properties to ignore during updates |\n\n### Permission Object Structure\n\n```typescript\ninterface RoleDefinitionPermission {\n  actions?: string[];        // Control plane allowed actions\n  notActions?: string[];     // Control plane denied actions\n  dataActions?: string[];    // Data plane allowed actions\n  notDataActions?: string[]; // Data plane denied actions\n}\n```\n\n## Available Outputs\n\nThe RoleDefinition construct exposes these outputs:\n\n- `id`: Full resource ID of the role definition\n- `name`: Name of the role definition\n- `resourceId`: Alias for id (for use in other resources)\n- `roleName`: Display name of the role\n- `roleType`: Type of role (CustomRole or BuiltInRole)\n\n## Common Permission Patterns\n\n### Reader Pattern\n```typescript\npermissions: [{\n  actions: [\"Microsoft.Resources/subscriptions/read\"]\n}]\n```\n\n### Contributor Pattern\n```typescript\npermissions: [{\n  actions: [\"*\"],\n  notActions: [\n    \"Microsoft.Authorization/roleAssignments/write\",\n    \"Microsoft.Authorization/roleAssignments/delete\"\n  ]\n}]\n```\n\n### Service-Specific Reader\n```typescript\npermissions: [{\n  actions: [\n    \"Microsoft.Compute/virtualMachines/read\",\n    \"Microsoft.Compute/disks/read\",\n    \"Microsoft.Compute/snapshots/read\"\n  ]\n}]\n```\n\n### Data Plane Access\n```typescript\npermissions: [{\n  dataActions: [\n    \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\",\n    \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write\"\n  ]\n}]\n```\n\n## Relationship with Role Assignment\n\nAfter creating a Role Definition, use the RoleAssignment service to assign the role to principals:\n\n```typescript\nimport { RoleDefinition } from \"@cdktf/terraform-cdk-constructs/azure-roledefinition\";\nimport { RoleAssignment } from \"@cdktf/terraform-cdk-constructs/azure-roleassignment\";\n\n// Create custom role\nconst customRole = new RoleDefinition(this, \"custom-role\", {\n  roleName: \"Custom Operator\",\n  permissions: [\n    {\n      actions: [\"Microsoft.Compute/virtualMachines/read\"]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n\n// Assign the role to a principal (user, group, or service principal)\nconst assignment = new RoleAssignment(this, \"role-assignment\", {\n  name: \"custom-role-assignment\",\n  roleDefinitionId: customRole.id,\n  principalId: \"00000000-0000-0000-0000-000000000000\", // User/Group/SP Object ID\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n});\n```\n\n## Best Practices\n\n### 1. Principle of Least Privilege\nGrant only the minimum permissions required for the role's purpose:\n\n```typescript\n// Good: Specific permissions\npermissions: [{\n  actions: [\n    \"Microsoft.Compute/virtualMachines/read\",\n    \"Microsoft.Compute/virtualMachines/start/action\"\n  ]\n}]\n\n// Avoid: Overly broad permissions\npermissions: [{\n  actions: [\"*\"]\n}]\n```\n\n### 2. Use NotActions Carefully\nNotActions exclude permissions from a broader grant. Use them to create exceptions:\n\n```typescript\npermissions: [{\n  actions: [\"Microsoft.Compute/virtualMachines/*\"],\n  notActions: [\n    \"Microsoft.Compute/virtualMachines/delete\",\n    \"Microsoft.Compute/virtualMachines/write\"\n  ]\n}]\n```\n\n### 3. Document Role Purpose\nProvide clear descriptions:\n\n```typescript\nconst role = new RoleDefinition(this, \"role\", {\n  roleName: \"VM Operator\",\n  description: \"Can start, stop, and restart VMs. Cannot create, modify, or delete VMs. Intended for operations team.\",\n  // ...\n});\n```\n\n### 4. Scope Appropriately\nLimit assignable scopes to only where needed:\n\n```typescript\n// Good: Limited to specific resource group\nassignableScopes: [\n  \"/subscriptions/sub-id/resourceGroups/production-vms\"\n]\n\n// Avoid: Too broad if not necessary\nassignableScopes: [\n  \"/subscriptions/sub-id\"\n]\n```\n\n### 5. Separate Control and Data Plane\nUnderstand the difference between actions and dataActions:\n\n```typescript\npermissions: [{\n  // Control plane: Manage the resource itself\n  actions: [\"Microsoft.Storage/storageAccounts/read\"],\n\n  // Data plane: Access data within the resource\n  dataActions: [\n    \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\"\n  ]\n}]\n```\n\n### 6. Test Permissions\nAlways test that the role grants the intended access and nothing more:\n\n1. Assign the role to a test principal\n2. Verify the principal can perform allowed actions\n3. Verify the principal cannot perform denied actions\n4. Check at all intended assignable scopes\n\n## Understanding Actions\n\n### Wildcard Usage\n- `*`: All actions\n- `Microsoft.Compute/*`: All actions in Compute resource provider\n- `Microsoft.Compute/virtualMachines/*`: All actions on VMs\n\n### Action Format\nActions follow the pattern: `{Provider}/{ResourceType}/{Operation}`\n\nExamples:\n- `Microsoft.Compute/virtualMachines/read`\n- `Microsoft.Network/virtualNetworks/write`\n- `Microsoft.Storage/storageAccounts/listkeys/action`\n\n### Control Plane vs Data Plane\n- **Control Plane (actions)**: Manage Azure resources\n  - Example: Create VM, delete storage account\n- **Data Plane (dataActions)**: Access data in resources\n  - Example: Read blob, write to queue\n\n## Migration Notes\n\nThis implementation uses the AZAPI provider with version-aware schema management. When migrating from other implementations:\n\n1. Role definitions are subscription or management group scoped (no location property)\n2. Use the `permissions` array to define role capabilities\n3. Specify `assignableScopes` to control where the role can be assigned\n4. The construct automatically resolves to the latest API version unless pinned\n\n## Troubleshooting\n\n### Role Not Appearing in Portal\n- Wait a few minutes for replication\n- Check that you're viewing the correct subscription/scope\n- Verify the role was created successfully via API\n\n### Permission Denied When Using Role\n- Check that the role includes the required actions\n- Verify the assignable scopes include the target scope\n- Ensure the role has been assigned to the principal\n\n### Role Cannot Be Deleted\n- Check if any role assignments reference this role definition\n- Remove all assignments before deleting the definition\n\n## Additional Resources\n\n- [Azure RBAC Documentation](https://docs.microsoft.com/azure/role-based-access-control/)\n- [Azure Resource Provider Operations](https://docs.microsoft.com/azure/role-based-access-control/resource-provider-operations)\n- [AZAPI Provider Documentation](https://registry.terraform.io/providers/Azure/azapi/latest/docs)\n- [Custom Roles in Azure](https://docs.microsoft.com/azure/role-based-access-control/custom-roles)\n"
+        "markdown": "# Azure Role Definition Construct\n\nThis module provides a CDK for Terraform (CDKTF) construct for managing Azure RBAC Role Definitions using the AZAPI provider. Role definitions define custom roles with specific permissions that can be assigned to users, groups, or service principals through role assignments.\n\n## Features\n\n- **Version-Aware Schema Management**: Automatic handling of API version resolution and schema validation\n- **Custom RBAC Roles**: Define custom roles with granular permissions\n- **Control Plane Actions**: Specify allowed and denied management operations\n- **Data Plane Actions**: Define permissions for data operations within resources\n- **Flexible Scoping**: Assign roles at subscription, resource group, or management group level\n- **Type Safety**: Full TypeScript support with comprehensive type definitions\n- **JSII Compliance**: Multi-language support (TypeScript, Python, Java, C#, Go)\n\n## AZAPI Provider Benefits\n\nThis construct uses the AZAPI provider, which offers several advantages:\n\n- **Day-0 Support**: Access to new Azure features immediately upon release\n- **Consistent API**: Direct mapping to Azure REST API structure\n- **Reduced Complexity**: No need to wait for provider updates\n- **Better Compatibility**: Works seamlessly with the latest Azure features\n\n## Installation\n\n```bash\nnpm install @cdktf/terraform-cdk-constructs\n```\n\n## Supported API Versions\n\n| API Version | Support Level | Release Date | Status |\n|-------------|---------------|--------------|--------|\n| 2022-04-01  | Active        | 2022-04-01   | Latest |\n\n## Basic Usage\n\n### Create a Simple Read-Only Role\n\n```typescript\nimport { RoleDefinition } from \"@cdktf/terraform-cdk-constructs/azure-roledefinition\";\n\nconst vmReaderRole = new RoleDefinition(this, \"vm-reader\", {\n  name: \"vm-reader-role\",\n  roleName: \"Virtual Machine Reader\",\n  description: \"Can view virtual machines and their properties\",\n  permissions: [\n    {\n      actions: [\n        \"Microsoft.Compute/virtualMachines/read\",\n        \"Microsoft.Compute/virtualMachines/instanceView/read\",\n        \"Microsoft.Network/networkInterfaces/read\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n```\n\n## Advanced Features\n\n### Role with Data Plane Permissions\n\nCreate a role with both control plane and data plane permissions for comprehensive access management:\n\n```typescript\nconst storageOperator = new RoleDefinition(this, \"storage-operator\", {\n  name: \"storage-operator-role\",\n  roleName: \"Storage Operator\",\n  description: \"Can manage storage accounts and read/write blob data\",\n  permissions: [\n    {\n      // Control plane actions - manage storage accounts\n      actions: [\n        \"Microsoft.Storage/storageAccounts/read\",\n        \"Microsoft.Storage/storageAccounts/write\",\n        \"Microsoft.Storage/storageAccounts/listkeys/action\"\n      ],\n      // Explicitly deny delete operations\n      notActions: [\n        \"Microsoft.Storage/storageAccounts/delete\"\n      ],\n      // Data plane actions - read and write blobs\n      dataActions: [\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\",\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write\"\n      ],\n      // Explicitly deny delete operations on data plane\n      notDataActions: [\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n```\n\n### Role with Management Group Scope\n\nDefine a role that can be assigned at management group level for organization-wide access:\n\n```typescript\nconst orgRole = new RoleDefinition(this, \"org-role\", {\n  name: \"org-wide-role\",\n  roleName: \"Organization Reader\",\n  description: \"Can view resources across the entire organization hierarchy\",\n  permissions: [\n    {\n      actions: [\n        \"Microsoft.Resources/subscriptions/read\",\n        \"Microsoft.Resources/subscriptions/resourceGroups/read\",\n        \"Microsoft.Management/managementGroups/read\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/providers/Microsoft.Management/managementGroups/my-mg\"\n  ]\n});\n```\n\n### Multiple Assignable Scopes\n\nDefine a role that can be assigned at multiple levels:\n\n```typescript\nconst multiScopeRole = new RoleDefinition(this, \"multi-scope\", {\n  name: \"multi-scope-role\",\n  roleName: \"Multi-Scope Operator\",\n  description: \"Can be assigned at subscription, resource group, or management group level\",\n  permissions: [\n    {\n      actions: [\n        \"Microsoft.Resources/subscriptions/read\",\n        \"Microsoft.Resources/subscriptions/resourceGroups/read\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n    \"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg1\",\n    \"/providers/Microsoft.Management/managementGroups/mg1\"\n  ]\n});\n```\n\n### Complex Permission Combinations\n\nCreate sophisticated roles with multiple permission objects:\n\n```typescript\nconst complexRole = new RoleDefinition(this, \"complex-role\", {\n  name: \"complex-role\",\n  roleName: \"Complex Operator Role\",\n  description: \"Role with multiple permission sets\",\n  permissions: [\n    {\n      // Compute permissions\n      actions: [\"Microsoft.Compute/virtualMachines/read\"],\n      notActions: []\n    },\n    {\n      // Storage permissions\n      actions: [\"Microsoft.Storage/storageAccounts/read\"],\n      dataActions: [\n        \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\"\n      ]\n    },\n    {\n      // Network permissions\n      actions: [\n        \"Microsoft.Network/virtualNetworks/read\",\n        \"Microsoft.Network/networkInterfaces/read\"\n      ]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n```\n\n## Properties\n\n### Required Properties\n\n| Property | Type | Description |\n|----------|------|-------------|\n| `roleName` | string | Display name of the role (1-128 characters) |\n| `permissions` | RoleDefinitionPermission[] | Array of permission objects defining role capabilities |\n| `assignableScopes` | string[] | Scopes where the role can be assigned |\n\n### Optional Properties\n\n| Property | Type | Default | Description |\n|----------|------|---------|-------------|\n| `name` | string | Auto-generated | Resource name for the role definition |\n| `description` | string | - | Detailed description of the role (max 1024 characters) |\n| `type` | string | \"CustomRole\" | Role type (CustomRole or BuiltInRole) |\n| `apiVersion` | string | \"2022-04-01\" | Azure API version to use |\n| `ignoreChanges` | string[] | - | Properties to ignore during updates |\n\n### Permission Object Structure\n\n```typescript\ninterface RoleDefinitionPermission {\n  actions?: string[];        // Control plane allowed actions\n  notActions?: string[];     // Control plane denied actions\n  dataActions?: string[];    // Data plane allowed actions\n  notDataActions?: string[]; // Data plane denied actions\n}\n```\n\n## Available Outputs\n\nThe RoleDefinition construct exposes these outputs:\n\n- `id`: Full resource ID of the role definition\n- `name`: Name of the role definition\n- `resourceId`: Alias for id (for use in other resources)\n- `roleName`: Display name of the role\n- `roleType`: Type of role (CustomRole or BuiltInRole)\n\n## Common Permission Patterns\n\n### Reader Pattern\n```typescript\npermissions: [{\n  actions: [\"Microsoft.Resources/subscriptions/read\"]\n}]\n```\n\n### Contributor Pattern\n```typescript\npermissions: [{\n  actions: [\"*\"],\n  notActions: [\n    \"Microsoft.Authorization/roleAssignments/write\",\n    \"Microsoft.Authorization/roleAssignments/delete\"\n  ]\n}]\n```\n\n### Service-Specific Reader\n```typescript\npermissions: [{\n  actions: [\n    \"Microsoft.Compute/virtualMachines/read\",\n    \"Microsoft.Compute/disks/read\",\n    \"Microsoft.Compute/snapshots/read\"\n  ]\n}]\n```\n\n### Data Plane Access\n```typescript\npermissions: [{\n  dataActions: [\n    \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\",\n    \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write\"\n  ]\n}]\n```\n\n## Relationship with Role Assignment\n\nAfter creating a Role Definition, use the RoleAssignment service to assign the role to principals:\n\n```typescript\nimport { RoleDefinition } from \"@cdktf/terraform-cdk-constructs/azure-roledefinition\";\nimport { RoleAssignment } from \"@cdktf/terraform-cdk-constructs/azure-roleassignment\";\n\n// Create custom role\nconst customRole = new RoleDefinition(this, \"custom-role\", {\n  roleName: \"Custom Operator\",\n  permissions: [\n    {\n      actions: [\"Microsoft.Compute/virtualMachines/read\"]\n    }\n  ],\n  assignableScopes: [\n    \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n  ]\n});\n\n// Assign the role to a principal (user, group, or service principal)\nconst assignment = new RoleAssignment(this, \"role-assignment\", {\n  name: \"custom-role-assignment\",\n  roleDefinitionId: customRole.id,\n  principalId: \"00000000-0000-0000-0000-000000000000\", // User/Group/SP Object ID\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\"\n});\n```\n\n## Best Practices\n\n### 1. Principle of Least Privilege\nGrant only the minimum permissions required for the role's purpose:\n\n```typescript\n// Good: Specific permissions\npermissions: [{\n  actions: [\n    \"Microsoft.Compute/virtualMachines/read\",\n    \"Microsoft.Compute/virtualMachines/start/action\"\n  ]\n}]\n\n// Avoid: Overly broad permissions\npermissions: [{\n  actions: [\"*\"]\n}]\n```\n\n### 2. Use NotActions Carefully\nNotActions exclude permissions from a broader grant. Use them to create exceptions:\n\n```typescript\npermissions: [{\n  actions: [\"Microsoft.Compute/virtualMachines/*\"],\n  notActions: [\n    \"Microsoft.Compute/virtualMachines/delete\",\n    \"Microsoft.Compute/virtualMachines/write\"\n  ]\n}]\n```\n\n### 3. Document Role Purpose\nProvide clear descriptions:\n\n```typescript\nconst role = new RoleDefinition(this, \"role\", {\n  roleName: \"VM Operator\",\n  description: \"Can start, stop, and restart VMs. Cannot create, modify, or delete VMs. Intended for operations team.\",\n  // ...\n});\n```\n\n### 4. Scope Appropriately\nLimit assignable scopes to only where needed:\n\n```typescript\n// Good: Limited to specific resource group\nassignableScopes: [\n  \"/subscriptions/sub-id/resourceGroups/production-vms\"\n]\n\n// Acceptable: Subscription level when needed\nassignableScopes: [\n  \"/subscriptions/sub-id\"\n]\n\n// Use carefully: Management group level only for organization-wide roles\nassignableScopes: [\n  \"/providers/Microsoft.Management/managementGroups/my-mg\"\n]\n```\n\n### 5. Separate Control and Data Plane\nUnderstand the difference between actions and dataActions:\n\n```typescript\npermissions: [{\n  // Control plane: Manage the resource itself\n  actions: [\"Microsoft.Storage/storageAccounts/read\"],\n\n  // Data plane: Access data within the resource\n  dataActions: [\n    \"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read\"\n  ]\n}]\n```\n\n### 6. Test Permissions\nAlways test that the role grants the intended access and nothing more:\n\n1. Assign the role to a test principal\n2. Verify the principal can perform allowed actions\n3. Verify the principal cannot perform denied actions\n4. Check at all intended assignable scopes\n\n## Understanding Actions\n\n### Wildcard Usage\n- `*`: All actions\n- `Microsoft.Compute/*`: All actions in Compute resource provider\n- `Microsoft.Compute/virtualMachines/*`: All actions on VMs\n\n### Action Format\nActions follow the pattern: `{Provider}/{ResourceType}/{Operation}`\n\nExamples:\n- `Microsoft.Compute/virtualMachines/read`\n- `Microsoft.Network/virtualNetworks/write`\n- `Microsoft.Storage/storageAccounts/listkeys/action`\n\n### Control Plane vs Data Plane\n- **Control Plane (actions)**: Manage Azure resources\n  - Example: Create VM, delete storage account\n- **Data Plane (dataActions)**: Access data in resources\n  - Example: Read blob, write to queue\n\n## Migration Notes\n\nThis implementation uses the AZAPI provider with version-aware schema management. When migrating from other implementations:\n\n1. Role definitions are subscription or management group scoped (no location property)\n2. Use the `permissions` array to define role capabilities\n3. Specify `assignableScopes` to control where the role can be assigned\n4. The construct automatically resolves to the latest API version unless pinned\n\n## Troubleshooting\n\n### Role Not Appearing in Portal\n- Wait a few minutes for replication\n- Check that you're viewing the correct subscription/scope\n- Verify the role was created successfully via API\n\n### Permission Denied When Using Role\n- Check that the role includes the required actions\n- Verify the assignable scopes include the target scope\n- Ensure the role has been assigned to the principal\n\n### Role Cannot Be Deleted\n- Check if any role assignments reference this role definition\n- Remove all assignments before deleting the definition\n\n## Additional Resources\n\n- [Azure RBAC Documentation](https://docs.microsoft.com/azure/role-based-access-control/)\n- [Azure Resource Provider Operations](https://docs.microsoft.com/azure/role-based-access-control/resource-provider-operations)\n- [AZAPI Provider Documentation](https://registry.terraform.io/providers/Azure/azapi/latest/docs)\n- [Custom Roles in Azure](https://docs.microsoft.com/azure/role-based-access-control/custom-roles)\n"
       },
       "symbolId": "src/azure-roledefinition/index:"
     },
@@ -26855,8 +26855,8 @@
       "assembly": "@microsoft/terraform-cdk-constructs",
       "base": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
       "docs": {
-        "example": "// Policy assignment with managed identity:\nconst assignment = new PolicyAssignment(this, \"assignment\", {\n  name: \"deploy-monitoring-assignment\",\n  policyDefinitionId: \"/providers/Microsoft.Authorization/policyDefinitions/policy-id\",\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  identity: {\n    type: \"SystemAssigned\"\n  }\n});",
-        "remarks": "This class provides a single, version-aware implementation for managing Azure\nPolicy Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\nNote: Policy assignments can be deployed at subscription, resource group, or resource scope.\nLike policy definitions, they do not have a location property as they are not region-specific.",
+        "example": "// Policy assignment at management group scope:\nconst mgAssignment = new PolicyAssignment(this, \"mgAssignment\", {\n  name: \"mg-policy-assignment\",\n  policyDefinitionId: \"/providers/Microsoft.Authorization/policyDefinitions/policy-id\",\n  scope: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  displayName: \"Management Group Policy\",\n  description: \"Applies policy across the entire management group hierarchy\"\n});",
+        "remarks": "This class provides a single, version-aware implementation for managing Azure\nPolicy Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\nNote: Policy assignments can be deployed at management group, subscription, resource group,\nor resource scope. Like policy definitions, they do not have a location property as they\nare not region-specific.",
         "stability": "stable",
         "summary": "Unified Azure Policy Assignment implementation."
       },
@@ -26869,7 +26869,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-          "line": 336
+          "line": 348
         },
         "parameters": [
           {
@@ -26904,7 +26904,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-        "line": 307
+        "line": 319
       },
       "methods": [
         {
@@ -26914,7 +26914,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 393
+            "line": 397
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -26933,7 +26933,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 416
+            "line": 420
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -26959,7 +26959,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 378
+            "line": 382
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -26977,7 +26977,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 447
+            "line": 451
           },
           "name": "resolveParentId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27003,7 +27003,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 385
+            "line": 389
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27025,7 +27025,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 403
+            "line": 407
           },
           "name": "supportsTags",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27047,7 +27047,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 474
+            "line": 478
           },
           "name": "assignmentScope",
           "type": {
@@ -27062,7 +27062,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 481
+            "line": 485
           },
           "name": "enforcementMode",
           "type": {
@@ -27076,7 +27076,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 321
+            "line": 333
           },
           "name": "idOutput",
           "type": {
@@ -27090,7 +27090,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 322
+            "line": 334
           },
           "name": "nameOutput",
           "type": {
@@ -27105,7 +27105,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 467
+            "line": 471
           },
           "name": "policyDefinitionId",
           "type": {
@@ -27120,7 +27120,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 318
+            "line": 330
           },
           "name": "props",
           "type": {
@@ -27135,7 +27135,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 460
+            "line": 464
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27157,7 +27157,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-        "line": 246
+        "line": 247
       },
       "name": "PolicyAssignmentBody",
       "properties": [
@@ -27170,7 +27170,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 250
+            "line": 251
           },
           "name": "properties",
           "type": {
@@ -27186,7 +27186,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 255
+            "line": 256
           },
           "name": "identity",
           "optional": true,
@@ -27317,7 +27317,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-        "line": 195
+        "line": 196
       },
       "name": "PolicyAssignmentProperties",
       "properties": [
@@ -27330,7 +27330,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 199
+            "line": 200
           },
           "name": "policyDefinitionId",
           "type": {
@@ -27346,7 +27346,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 204
+            "line": 205
           },
           "name": "scope",
           "type": {
@@ -27362,7 +27362,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 214
+            "line": 215
           },
           "name": "description",
           "optional": true,
@@ -27379,7 +27379,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 209
+            "line": 210
           },
           "name": "displayName",
           "optional": true,
@@ -27396,7 +27396,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 219
+            "line": 220
           },
           "name": "enforcementMode",
           "optional": true,
@@ -27413,7 +27413,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 229
+            "line": 230
           },
           "name": "metadata",
           "optional": true,
@@ -27430,7 +27430,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 239
+            "line": 240
           },
           "name": "nonComplianceMessages",
           "optional": true,
@@ -27452,7 +27452,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 234
+            "line": 235
           },
           "name": "notScopes",
           "optional": true,
@@ -27474,7 +27474,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 224
+            "line": 225
           },
           "name": "parameters",
           "optional": true,
@@ -27526,12 +27526,12 @@
           "docs": {
             "example": "\"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name\"",
             "stability": "stable",
-            "summary": "The scope at which the policy assignment is applied Can be a subscription, resource group, or resource Required property."
+            "summary": "The scope at which the policy assignment is applied Can be a management group, subscription, resource group, or resource Required property."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 98
+            "line": 99
           },
           "name": "scope",
           "type": {
@@ -27548,7 +27548,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 114
+            "line": 115
           },
           "name": "description",
           "optional": true,
@@ -27566,7 +27566,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 106
+            "line": 107
           },
           "name": "displayName",
           "optional": true,
@@ -27585,7 +27585,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 122
+            "line": 123
           },
           "name": "enforcementMode",
           "optional": true,
@@ -27603,7 +27603,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 161
+            "line": 162
           },
           "name": "identity",
           "optional": true,
@@ -27621,7 +27621,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 188
+            "line": 189
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -27644,7 +27644,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 150
+            "line": 151
           },
           "name": "metadata",
           "optional": true,
@@ -27662,7 +27662,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 182
+            "line": 183
           },
           "name": "nonComplianceMessages",
           "optional": true,
@@ -27685,7 +27685,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 169
+            "line": 170
           },
           "name": "notScopes",
           "optional": true,
@@ -27708,7 +27708,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 138
+            "line": 139
           },
           "name": "parameters",
           "optional": true,
@@ -27723,7 +27723,7 @@
       "assembly": "@microsoft/terraform-cdk-constructs",
       "base": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
       "docs": {
-        "example": "// Policy definition with parameters:\nconst policyDefinition = new PolicyDefinition(this, \"policy\", {\n  name: \"require-tag-policy\",\n  displayName: \"Require tag on resources\",\n  policyRule: {\n    if: {\n      field: \"[concat('tags[', parameters('tagName'), ']')]\",\n      exists: \"false\"\n    },\n    then: {\n      effect: \"deny\"\n    }\n  },\n  parameters: {\n    tagName: {\n      type: \"String\",\n      metadata: {\n        displayName: \"Tag Name\"\n      }\n    }\n  }\n});",
+        "example": "// Policy definition at management group scope:\nconst mgPolicyDefinition = new PolicyDefinition(this, \"mgPolicy\", {\n  name: \"mg-require-tag-policy\",\n  parentId: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  displayName: \"Management Group Tag Policy\",\n  description: \"Enforces tags across the management group hierarchy\",\n  policyRule: {\n    if: {\n      field: \"tags['CostCenter']\",\n      exists: \"false\"\n    },\n    then: {\n      effect: \"deny\"\n    }\n  }\n});",
         "remarks": "This class provides a single, version-aware implementation for managing Azure\nPolicy Definitions. It automatically handles version resolution, schema validation,\nand property transformation.\n\nNote: Policy definitions are deployed at subscription or management group scope.\nUnlike most Azure resources, they do not have a location property as they are\nnot region-specific.",
         "stability": "stable",
         "summary": "Unified Azure Policy Definition implementation."
@@ -27737,7 +27737,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-          "line": 257
+          "line": 286
         },
         "parameters": [
           {
@@ -27772,7 +27772,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-        "line": 228
+        "line": 257
       },
       "methods": [
         {
@@ -27782,7 +27782,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 306
+            "line": 335
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27801,7 +27801,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 317
+            "line": 346
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27832,7 +27832,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 358
+            "line": 387
           },
           "name": "customizeResourceConfig",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27861,7 +27861,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 291
+            "line": 320
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27872,6 +27872,32 @@
             }
           }
         },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "Overrides parent ID resolution to use parentId from props if provided Policy definitions can be deployed at subscription or management group scope."
+          },
+          "locationInModule": {
+            "filename": "src/azure-policydefinition/lib/policy-definition.ts",
+            "line": 404
+          },
+          "name": "resolveParentId",
+          "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
+          "parameters": [
+            {
+              "name": "props",
+              "type": {
+                "primitive": "any"
+              }
+            }
+          ],
+          "protected": true,
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          }
+        },
         {
           "docs": {
             "stability": "stable",
@@ -27879,7 +27905,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 298
+            "line": 327
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27901,7 +27927,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 341
+            "line": 370
           },
           "name": "supportsTags",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -27922,7 +27948,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 242
+            "line": 271
           },
           "name": "idOutput",
           "type": {
@@ -27936,7 +27962,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 243
+            "line": 272
           },
           "name": "nameOutput",
           "type": {
@@ -27951,7 +27977,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 393
+            "line": 438
           },
           "name": "policyMode",
           "type": {
@@ -27966,7 +27992,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 386
+            "line": 431
           },
           "name": "policyType",
           "type": {
@@ -27981,7 +28007,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 239
+            "line": 268
           },
           "name": "props",
           "type": {
@@ -27996,7 +28022,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 379
+            "line": 424
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -28018,7 +28044,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-        "line": 167
+        "line": 178
       },
       "name": "PolicyDefinitionBody",
       "properties": [
@@ -28031,7 +28057,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 171
+            "line": 182
           },
           "name": "properties",
           "type": {
@@ -28052,7 +28078,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-        "line": 126
+        "line": 137
       },
       "name": "PolicyDefinitionProperties",
       "properties": [
@@ -28065,7 +28091,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 150
+            "line": 161
           },
           "name": "policyRule",
           "type": {
@@ -28081,7 +28107,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 135
+            "line": 146
           },
           "name": "description",
           "optional": true,
@@ -28098,7 +28124,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 130
+            "line": 141
           },
           "name": "displayName",
           "optional": true,
@@ -28115,7 +28141,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 160
+            "line": 171
           },
           "name": "metadata",
           "optional": true,
@@ -28132,7 +28158,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 145
+            "line": 156
           },
           "name": "mode",
           "optional": true,
@@ -28149,7 +28175,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 155
+            "line": 166
           },
           "name": "parameters",
           "optional": true,
@@ -28166,7 +28192,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 140
+            "line": 151
           },
           "name": "policyType",
           "optional": true,
@@ -28259,7 +28285,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 119
+            "line": 130
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -28327,6 +28353,25 @@
             "primitive": "any"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "Subscription scope (auto-detected from client config)",
+            "example": "\"/subscriptions/00000000-0000-0000-0000-000000000000\"",
+            "stability": "stable",
+            "summary": "The parent scope where the policy definition should be created Can be a management group or subscription scope If not specified, defaults to subscription scope."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/azure-policydefinition/lib/policy-definition.ts",
+            "line": 124
+          },
+          "name": "parentId",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -37030,8 +37075,8 @@
       "assembly": "@microsoft/terraform-cdk-constructs",
       "base": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
       "docs": {
-        "example": "Conditional assignment with ABAC - Limit access to specific storage containers\n\nconst assignment = new RoleAssignment(this, \"conditional-assignment\", {\n  roleDefinitionId: storageRole.id,\n  principalId: user.objectId,\n  scope: storageAccount.id,\n  principalType: \"User\",\n  condition: \"@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'logs'\",\n  conditionVersion: \"2.0\",\n  description: \"Grants access only to the logs container\",\n});",
-        "remarks": "This class provides a single, version-aware implementation for managing Azure\nRole Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\n**Important Notes:**\n- Role assignments are scoped resources deployed at subscription, resource group,\n  or resource level. They do not have a location property as they are not region-specific.\n- The `name` property (inherited from AzapiResourceProps) is not used. Azure automatically\n  generates a deterministic GUID for role assignment names based on the deployment context.\n  This ensures idempotent deployments without duplicate role assignments.",
+        "example": "Management group scoped assignment - Assign Reader role at management group level\n\nconst mgAssignment = new RoleAssignment(this, \"mg-assignment\", {\n  roleDefinitionId: \"/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7\",\n  principalId: \"00000000-0000-0000-0000-000000000000\",\n  scope: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  principalType: \"Group\",\n  description: \"Grants read access across the entire management group hierarchy\",\n});",
+        "remarks": "This class provides a single, version-aware implementation for managing Azure\nRole Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\n**Important Notes:**\n- Role assignments are scoped resources deployed at management group, subscription,\n  resource group, or resource level. They do not have a location property as they\n  are not region-specific.\n- The `name` property (inherited from AzapiResourceProps) is not used. Azure automatically\n  generates a deterministic GUID for role assignment names based on the deployment context.\n  This ensures idempotent deployments without duplicate role assignments.",
         "stability": "stable",
         "summary": "Unified Azure Role Assignment implementation."
       },
@@ -37044,7 +37089,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-          "line": 268
+          "line": 281
         },
         "parameters": [
           {
@@ -37079,7 +37124,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-        "line": 239
+        "line": 252
       },
       "methods": [
         {
@@ -37089,7 +37134,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 322
+            "line": 335
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37104,11 +37149,11 @@
           "docs": {
             "remarks": "The scope property is NOT included in the body as it's read-only and\nautomatically derived from the parentId.",
             "stability": "stable",
-            "summary": "Creates the resource body for the Azure API call Transforms the input properties into the JSON format expected by Azure REST API  Note: Role assignments do not have a location property as they are scoped resources (subscription, resource group, or resource level)."
+            "summary": "Creates the resource body for the Azure API call Transforms the input properties into the JSON format expected by Azure REST API  Note: Role assignments do not have a location property as they are scoped resources (management group, subscription, resource group, or resource level)."
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 335
+            "line": 348
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37134,7 +37179,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 307
+            "line": 320
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37153,7 +37198,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 361
+            "line": 374
           },
           "name": "resolveName",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37179,7 +37224,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 387
+            "line": 400
           },
           "name": "resolveParentId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37205,7 +37250,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 314
+            "line": 327
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37227,7 +37272,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 421
+            "line": 434
           },
           "name": "assignmentScope",
           "type": {
@@ -37241,7 +37286,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 253
+            "line": 266
           },
           "name": "idOutput",
           "type": {
@@ -37255,7 +37300,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 254
+            "line": 267
           },
           "name": "nameOutput",
           "type": {
@@ -37270,7 +37315,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 414
+            "line": 427
           },
           "name": "principalId",
           "type": {
@@ -37285,7 +37330,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 250
+            "line": 263
           },
           "name": "props",
           "type": {
@@ -37300,7 +37345,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 400
+            "line": 413
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37316,7 +37361,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 407
+            "line": 420
           },
           "name": "roleDefinitionId",
           "type": {
@@ -37331,7 +37376,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 428
+            "line": 441
           },
           "name": "principalType",
           "optional": true,
@@ -37353,7 +37398,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-        "line": 182
+        "line": 183
       },
       "name": "RoleAssignmentBody",
       "properties": [
@@ -37366,7 +37411,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 186
+            "line": 187
           },
           "name": "properties",
           "type": {
@@ -37387,7 +37432,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-        "line": 136
+        "line": 137
       },
       "name": "RoleAssignmentProperties",
       "properties": [
@@ -37400,7 +37445,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 145
+            "line": 146
           },
           "name": "principalId",
           "type": {
@@ -37416,7 +37461,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 140
+            "line": 141
           },
           "name": "roleDefinitionId",
           "type": {
@@ -37432,7 +37477,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 150
+            "line": 151
           },
           "name": "scope",
           "type": {
@@ -37448,7 +37493,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 165
+            "line": 166
           },
           "name": "condition",
           "optional": true,
@@ -37465,7 +37510,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 170
+            "line": 171
           },
           "name": "conditionVersion",
           "optional": true,
@@ -37482,7 +37527,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 175
+            "line": 176
           },
           "name": "delegatedManagedIdentityResourceId",
           "optional": true,
@@ -37499,7 +37544,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 160
+            "line": 161
           },
           "name": "description",
           "optional": true,
@@ -37516,7 +37561,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 155
+            "line": 156
           },
           "name": "principalType",
           "optional": true,
@@ -37585,12 +37630,12 @@
           "docs": {
             "example": "\"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.Storage/storageAccounts/storage-name\"",
             "stability": "stable",
-            "summary": "The scope at which the role assignment is applied Can be a subscription, resource group, or resource Required property."
+            "summary": "The scope at which the role assignment is applied Can be a management group, subscription, resource group, or resource Required property."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 75
+            "line": 76
           },
           "name": "scope",
           "type": {
@@ -37607,7 +37652,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 105
+            "line": 106
           },
           "name": "condition",
           "optional": true,
@@ -37626,7 +37671,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 114
+            "line": 115
           },
           "name": "conditionVersion",
           "optional": true,
@@ -37644,7 +37689,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 123
+            "line": 124
           },
           "name": "delegatedManagedIdentityResourceId",
           "optional": true,
@@ -37662,7 +37707,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 96
+            "line": 97
           },
           "name": "description",
           "optional": true,
@@ -37680,7 +37725,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 129
+            "line": 130
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -37704,7 +37749,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 88
+            "line": 89
           },
           "name": "principalType",
           "optional": true,
@@ -37733,7 +37778,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-roledefinition/lib/role-definition.ts",
-          "line": 223
+          "line": 224
         },
         "parameters": [
           {
@@ -37768,7 +37813,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-roledefinition/lib/role-definition.ts",
-        "line": 194
+        "line": 195
       },
       "methods": [
         {
@@ -37778,7 +37823,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 272
+            "line": 273
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37797,7 +37842,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 313
+            "line": 314
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37823,7 +37868,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 257
+            "line": 258
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37842,7 +37887,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 285
+            "line": 286
           },
           "name": "resolveName",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37868,7 +37913,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 264
+            "line": 265
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37889,7 +37934,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 208
+            "line": 209
           },
           "name": "idOutput",
           "type": {
@@ -37903,7 +37948,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 209
+            "line": 210
           },
           "name": "nameOutput",
           "type": {
@@ -37918,7 +37963,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 205
+            "line": 206
           },
           "name": "props",
           "type": {
@@ -37933,7 +37978,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 334
+            "line": 335
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -37949,7 +37994,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 341
+            "line": 342
           },
           "name": "roleName",
           "type": {
@@ -37964,7 +38009,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 348
+            "line": 349
           },
           "name": "roleType",
           "type": {
@@ -37985,7 +38030,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roledefinition/lib/role-definition.ts",
-        "line": 169
+        "line": 170
       },
       "name": "RoleDefinitionBody",
       "properties": [
@@ -37998,7 +38043,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 173
+            "line": 174
           },
           "name": "properties",
           "type": {
@@ -38129,7 +38174,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roledefinition/lib/role-definition.ts",
-        "line": 138
+        "line": 139
       },
       "name": "RoleDefinitionProperties",
       "properties": [
@@ -38142,7 +38187,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 162
+            "line": 163
           },
           "name": "assignableScopes",
           "type": {
@@ -38163,7 +38208,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 157
+            "line": 158
           },
           "name": "permissions",
           "type": {
@@ -38184,7 +38229,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 142
+            "line": 143
           },
           "name": "roleName",
           "type": {
@@ -38200,7 +38245,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 147
+            "line": 148
           },
           "name": "description",
           "optional": true,
@@ -38217,7 +38262,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 152
+            "line": 153
           },
           "name": "type",
           "optional": true,
@@ -38250,14 +38295,14 @@
         {
           "abstract": true,
           "docs": {
-            "example": "[\"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name\"]",
+            "example": "[\"/providers/Microsoft.Management/managementGroups/my-mg\"]",
             "stability": "stable",
             "summary": "An array of scopes where this role can be assigned Can include subscription, resource group, or management group scopes Required property."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 125
+            "line": 126
           },
           "name": "assignableScopes",
           "type": {
@@ -38336,7 +38381,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 131
+            "line": 132
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -70412,8 +70457,8 @@
       "assembly": "@microsoft/terraform-cdk-constructs",
       "base": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
       "docs": {
-        "example": "// Policy assignment with managed identity:\nconst assignment = new PolicyAssignment(this, \"assignment\", {\n  name: \"deploy-monitoring-assignment\",\n  policyDefinitionId: \"/providers/Microsoft.Authorization/policyDefinitions/policy-id\",\n  scope: \"/subscriptions/00000000-0000-0000-0000-000000000000\",\n  identity: {\n    type: \"SystemAssigned\"\n  }\n});",
-        "remarks": "This class provides a single, version-aware implementation for managing Azure\nPolicy Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\nNote: Policy assignments can be deployed at subscription, resource group, or resource scope.\nLike policy definitions, they do not have a location property as they are not region-specific.",
+        "example": "// Policy assignment at management group scope:\nconst mgAssignment = new PolicyAssignment(this, \"mgAssignment\", {\n  name: \"mg-policy-assignment\",\n  policyDefinitionId: \"/providers/Microsoft.Authorization/policyDefinitions/policy-id\",\n  scope: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  displayName: \"Management Group Policy\",\n  description: \"Applies policy across the entire management group hierarchy\"\n});",
+        "remarks": "This class provides a single, version-aware implementation for managing Azure\nPolicy Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\nNote: Policy assignments can be deployed at management group, subscription, resource group,\nor resource scope. Like policy definitions, they do not have a location property as they\nare not region-specific.",
         "stability": "stable",
         "summary": "Unified Azure Policy Assignment implementation."
       },
@@ -70426,7 +70471,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-          "line": 336
+          "line": 348
         },
         "parameters": [
           {
@@ -70461,7 +70506,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-        "line": 307
+        "line": 319
       },
       "methods": [
         {
@@ -70471,7 +70516,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 393
+            "line": 397
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -70490,7 +70535,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 416
+            "line": 420
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -70516,7 +70561,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 378
+            "line": 382
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -70534,7 +70579,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 447
+            "line": 451
           },
           "name": "resolveParentId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -70560,7 +70605,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 385
+            "line": 389
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -70582,7 +70627,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 403
+            "line": 407
           },
           "name": "supportsTags",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -70605,7 +70650,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 474
+            "line": 478
           },
           "name": "assignmentScope",
           "type": {
@@ -70620,7 +70665,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 481
+            "line": 485
           },
           "name": "enforcementMode",
           "type": {
@@ -70634,7 +70679,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 321
+            "line": 333
           },
           "name": "idOutput",
           "type": {
@@ -70648,7 +70693,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 322
+            "line": 334
           },
           "name": "nameOutput",
           "type": {
@@ -70663,7 +70708,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 467
+            "line": 471
           },
           "name": "policyDefinitionId",
           "type": {
@@ -70678,7 +70723,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 318
+            "line": 330
           },
           "name": "props",
           "type": {
@@ -70693,7 +70738,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 460
+            "line": 464
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -70715,7 +70760,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-        "line": 246
+        "line": 247
       },
       "name": "PolicyAssignmentBody",
       "namespace": "azure_policyassignment",
@@ -70729,7 +70774,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 250
+            "line": 251
           },
           "name": "properties",
           "type": {
@@ -70745,7 +70790,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 255
+            "line": 256
           },
           "name": "identity",
           "optional": true,
@@ -70878,7 +70923,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-        "line": 195
+        "line": 196
       },
       "name": "PolicyAssignmentProperties",
       "namespace": "azure_policyassignment",
@@ -70892,7 +70937,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 199
+            "line": 200
           },
           "name": "policyDefinitionId",
           "type": {
@@ -70908,7 +70953,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 204
+            "line": 205
           },
           "name": "scope",
           "type": {
@@ -70924,7 +70969,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 214
+            "line": 215
           },
           "name": "description",
           "optional": true,
@@ -70941,7 +70986,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 209
+            "line": 210
           },
           "name": "displayName",
           "optional": true,
@@ -70958,7 +71003,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 219
+            "line": 220
           },
           "name": "enforcementMode",
           "optional": true,
@@ -70975,7 +71020,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 229
+            "line": 230
           },
           "name": "metadata",
           "optional": true,
@@ -70992,7 +71037,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 239
+            "line": 240
           },
           "name": "nonComplianceMessages",
           "optional": true,
@@ -71014,7 +71059,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 234
+            "line": 235
           },
           "name": "notScopes",
           "optional": true,
@@ -71036,7 +71081,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 224
+            "line": 225
           },
           "name": "parameters",
           "optional": true,
@@ -71089,12 +71134,12 @@
           "docs": {
             "example": "\"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name\"",
             "stability": "stable",
-            "summary": "The scope at which the policy assignment is applied Can be a subscription, resource group, or resource Required property."
+            "summary": "The scope at which the policy assignment is applied Can be a management group, subscription, resource group, or resource Required property."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 98
+            "line": 99
           },
           "name": "scope",
           "type": {
@@ -71111,7 +71156,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 114
+            "line": 115
           },
           "name": "description",
           "optional": true,
@@ -71129,7 +71174,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 106
+            "line": 107
           },
           "name": "displayName",
           "optional": true,
@@ -71148,7 +71193,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 122
+            "line": 123
           },
           "name": "enforcementMode",
           "optional": true,
@@ -71166,7 +71211,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 161
+            "line": 162
           },
           "name": "identity",
           "optional": true,
@@ -71184,7 +71229,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 188
+            "line": 189
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -71207,7 +71252,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 150
+            "line": 151
           },
           "name": "metadata",
           "optional": true,
@@ -71225,7 +71270,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 182
+            "line": 183
           },
           "name": "nonComplianceMessages",
           "optional": true,
@@ -71248,7 +71293,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 169
+            "line": 170
           },
           "name": "notScopes",
           "optional": true,
@@ -71271,7 +71316,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policyassignment/lib/policy-assignment.ts",
-            "line": 138
+            "line": 139
           },
           "name": "parameters",
           "optional": true,
@@ -71286,7 +71331,7 @@
       "assembly": "@microsoft/terraform-cdk-constructs",
       "base": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
       "docs": {
-        "example": "// Policy definition with parameters:\nconst policyDefinition = new PolicyDefinition(this, \"policy\", {\n  name: \"require-tag-policy\",\n  displayName: \"Require tag on resources\",\n  policyRule: {\n    if: {\n      field: \"[concat('tags[', parameters('tagName'), ']')]\",\n      exists: \"false\"\n    },\n    then: {\n      effect: \"deny\"\n    }\n  },\n  parameters: {\n    tagName: {\n      type: \"String\",\n      metadata: {\n        displayName: \"Tag Name\"\n      }\n    }\n  }\n});",
+        "example": "// Policy definition at management group scope:\nconst mgPolicyDefinition = new PolicyDefinition(this, \"mgPolicy\", {\n  name: \"mg-require-tag-policy\",\n  parentId: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  displayName: \"Management Group Tag Policy\",\n  description: \"Enforces tags across the management group hierarchy\",\n  policyRule: {\n    if: {\n      field: \"tags['CostCenter']\",\n      exists: \"false\"\n    },\n    then: {\n      effect: \"deny\"\n    }\n  }\n});",
         "remarks": "This class provides a single, version-aware implementation for managing Azure\nPolicy Definitions. It automatically handles version resolution, schema validation,\nand property transformation.\n\nNote: Policy definitions are deployed at subscription or management group scope.\nUnlike most Azure resources, they do not have a location property as they are\nnot region-specific.",
         "stability": "stable",
         "summary": "Unified Azure Policy Definition implementation."
@@ -71300,7 +71345,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-          "line": 257
+          "line": 286
         },
         "parameters": [
           {
@@ -71335,7 +71380,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-        "line": 228
+        "line": 257
       },
       "methods": [
         {
@@ -71345,7 +71390,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 306
+            "line": 335
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -71364,7 +71409,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 317
+            "line": 346
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -71395,7 +71440,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 358
+            "line": 387
           },
           "name": "customizeResourceConfig",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -71424,7 +71469,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 291
+            "line": 320
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -71435,6 +71480,32 @@
             }
           }
         },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "Overrides parent ID resolution to use parentId from props if provided Policy definitions can be deployed at subscription or management group scope."
+          },
+          "locationInModule": {
+            "filename": "src/azure-policydefinition/lib/policy-definition.ts",
+            "line": 404
+          },
+          "name": "resolveParentId",
+          "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
+          "parameters": [
+            {
+              "name": "props",
+              "type": {
+                "primitive": "any"
+              }
+            }
+          ],
+          "protected": true,
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          }
+        },
         {
           "docs": {
             "stability": "stable",
@@ -71442,7 +71513,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 298
+            "line": 327
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -71464,7 +71535,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 341
+            "line": 370
           },
           "name": "supportsTags",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -71486,7 +71557,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 242
+            "line": 271
           },
           "name": "idOutput",
           "type": {
@@ -71500,7 +71571,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 243
+            "line": 272
           },
           "name": "nameOutput",
           "type": {
@@ -71515,7 +71586,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 393
+            "line": 438
           },
           "name": "policyMode",
           "type": {
@@ -71530,7 +71601,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 386
+            "line": 431
           },
           "name": "policyType",
           "type": {
@@ -71545,7 +71616,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 239
+            "line": 268
           },
           "name": "props",
           "type": {
@@ -71560,7 +71631,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 379
+            "line": 424
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -71582,7 +71653,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-        "line": 167
+        "line": 178
       },
       "name": "PolicyDefinitionBody",
       "namespace": "azure_policydefinition",
@@ -71596,7 +71667,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 171
+            "line": 182
           },
           "name": "properties",
           "type": {
@@ -71617,7 +71688,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-        "line": 126
+        "line": 137
       },
       "name": "PolicyDefinitionProperties",
       "namespace": "azure_policydefinition",
@@ -71631,7 +71702,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 150
+            "line": 161
           },
           "name": "policyRule",
           "type": {
@@ -71647,7 +71718,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 135
+            "line": 146
           },
           "name": "description",
           "optional": true,
@@ -71664,7 +71735,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 130
+            "line": 141
           },
           "name": "displayName",
           "optional": true,
@@ -71681,7 +71752,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 160
+            "line": 171
           },
           "name": "metadata",
           "optional": true,
@@ -71698,7 +71769,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 145
+            "line": 156
           },
           "name": "mode",
           "optional": true,
@@ -71715,7 +71786,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 155
+            "line": 166
           },
           "name": "parameters",
           "optional": true,
@@ -71732,7 +71803,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 140
+            "line": 151
           },
           "name": "policyType",
           "optional": true,
@@ -71826,7 +71897,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-policydefinition/lib/policy-definition.ts",
-            "line": 119
+            "line": 130
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -71894,6 +71965,25 @@
             "primitive": "any"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "Subscription scope (auto-detected from client config)",
+            "example": "\"/subscriptions/00000000-0000-0000-0000-000000000000\"",
+            "stability": "stable",
+            "summary": "The parent scope where the policy definition should be created Can be a management group or subscription scope If not specified, defaults to subscription scope."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/azure-policydefinition/lib/policy-definition.ts",
+            "line": 124
+          },
+          "name": "parentId",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -73587,8 +73677,8 @@
       "assembly": "@microsoft/terraform-cdk-constructs",
       "base": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
       "docs": {
-        "example": "Conditional assignment with ABAC - Limit access to specific storage containers\n\nconst assignment = new RoleAssignment(this, \"conditional-assignment\", {\n  roleDefinitionId: storageRole.id,\n  principalId: user.objectId,\n  scope: storageAccount.id,\n  principalType: \"User\",\n  condition: \"@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'logs'\",\n  conditionVersion: \"2.0\",\n  description: \"Grants access only to the logs container\",\n});",
-        "remarks": "This class provides a single, version-aware implementation for managing Azure\nRole Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\n**Important Notes:**\n- Role assignments are scoped resources deployed at subscription, resource group,\n  or resource level. They do not have a location property as they are not region-specific.\n- The `name` property (inherited from AzapiResourceProps) is not used. Azure automatically\n  generates a deterministic GUID for role assignment names based on the deployment context.\n  This ensures idempotent deployments without duplicate role assignments.",
+        "example": "Management group scoped assignment - Assign Reader role at management group level\n\nconst mgAssignment = new RoleAssignment(this, \"mg-assignment\", {\n  roleDefinitionId: \"/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7\",\n  principalId: \"00000000-0000-0000-0000-000000000000\",\n  scope: \"/providers/Microsoft.Management/managementGroups/my-mg\",\n  principalType: \"Group\",\n  description: \"Grants read access across the entire management group hierarchy\",\n});",
+        "remarks": "This class provides a single, version-aware implementation for managing Azure\nRole Assignments. It automatically handles version resolution, schema validation,\nand property transformation.\n\n**Important Notes:**\n- Role assignments are scoped resources deployed at management group, subscription,\n  resource group, or resource level. They do not have a location property as they\n  are not region-specific.\n- The `name` property (inherited from AzapiResourceProps) is not used. Azure automatically\n  generates a deterministic GUID for role assignment names based on the deployment context.\n  This ensures idempotent deployments without duplicate role assignments.",
         "stability": "stable",
         "summary": "Unified Azure Role Assignment implementation."
       },
@@ -73601,7 +73691,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-          "line": 268
+          "line": 281
         },
         "parameters": [
           {
@@ -73636,7 +73726,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-        "line": 239
+        "line": 252
       },
       "methods": [
         {
@@ -73646,7 +73736,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 322
+            "line": 335
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -73661,11 +73751,11 @@
           "docs": {
             "remarks": "The scope property is NOT included in the body as it's read-only and\nautomatically derived from the parentId.",
             "stability": "stable",
-            "summary": "Creates the resource body for the Azure API call Transforms the input properties into the JSON format expected by Azure REST API  Note: Role assignments do not have a location property as they are scoped resources (subscription, resource group, or resource level)."
+            "summary": "Creates the resource body for the Azure API call Transforms the input properties into the JSON format expected by Azure REST API  Note: Role assignments do not have a location property as they are scoped resources (management group, subscription, resource group, or resource level)."
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 335
+            "line": 348
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -73691,7 +73781,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 307
+            "line": 320
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -73710,7 +73800,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 361
+            "line": 374
           },
           "name": "resolveName",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -73736,7 +73826,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 387
+            "line": 400
           },
           "name": "resolveParentId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -73762,7 +73852,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 314
+            "line": 327
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -73785,7 +73875,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 421
+            "line": 434
           },
           "name": "assignmentScope",
           "type": {
@@ -73799,7 +73889,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 253
+            "line": 266
           },
           "name": "idOutput",
           "type": {
@@ -73813,7 +73903,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 254
+            "line": 267
           },
           "name": "nameOutput",
           "type": {
@@ -73828,7 +73918,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 414
+            "line": 427
           },
           "name": "principalId",
           "type": {
@@ -73843,7 +73933,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 250
+            "line": 263
           },
           "name": "props",
           "type": {
@@ -73858,7 +73948,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 400
+            "line": 413
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -73874,7 +73964,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 407
+            "line": 420
           },
           "name": "roleDefinitionId",
           "type": {
@@ -73889,7 +73979,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 428
+            "line": 441
           },
           "name": "principalType",
           "optional": true,
@@ -73911,7 +74001,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-        "line": 182
+        "line": 183
       },
       "name": "RoleAssignmentBody",
       "namespace": "azure_roleassignment",
@@ -73925,7 +74015,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 186
+            "line": 187
           },
           "name": "properties",
           "type": {
@@ -73946,7 +74036,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-        "line": 136
+        "line": 137
       },
       "name": "RoleAssignmentProperties",
       "namespace": "azure_roleassignment",
@@ -73960,7 +74050,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 145
+            "line": 146
           },
           "name": "principalId",
           "type": {
@@ -73976,7 +74066,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 140
+            "line": 141
           },
           "name": "roleDefinitionId",
           "type": {
@@ -73992,7 +74082,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 150
+            "line": 151
           },
           "name": "scope",
           "type": {
@@ -74008,7 +74098,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 165
+            "line": 166
           },
           "name": "condition",
           "optional": true,
@@ -74025,7 +74115,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 170
+            "line": 171
           },
           "name": "conditionVersion",
           "optional": true,
@@ -74042,7 +74132,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 175
+            "line": 176
           },
           "name": "delegatedManagedIdentityResourceId",
           "optional": true,
@@ -74059,7 +74149,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 160
+            "line": 161
           },
           "name": "description",
           "optional": true,
@@ -74076,7 +74166,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 155
+            "line": 156
           },
           "name": "principalType",
           "optional": true,
@@ -74146,12 +74236,12 @@
           "docs": {
             "example": "\"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name/providers/Microsoft.Storage/storageAccounts/storage-name\"",
             "stability": "stable",
-            "summary": "The scope at which the role assignment is applied Can be a subscription, resource group, or resource Required property."
+            "summary": "The scope at which the role assignment is applied Can be a management group, subscription, resource group, or resource Required property."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 75
+            "line": 76
           },
           "name": "scope",
           "type": {
@@ -74168,7 +74258,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 105
+            "line": 106
           },
           "name": "condition",
           "optional": true,
@@ -74187,7 +74277,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 114
+            "line": 115
           },
           "name": "conditionVersion",
           "optional": true,
@@ -74205,7 +74295,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 123
+            "line": 124
           },
           "name": "delegatedManagedIdentityResourceId",
           "optional": true,
@@ -74223,7 +74313,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 96
+            "line": 97
           },
           "name": "description",
           "optional": true,
@@ -74241,7 +74331,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 129
+            "line": 130
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -74265,7 +74355,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roleassignment/lib/role-assignment.ts",
-            "line": 88
+            "line": 89
           },
           "name": "principalType",
           "optional": true,
@@ -74294,7 +74384,7 @@
         },
         "locationInModule": {
           "filename": "src/azure-roledefinition/lib/role-definition.ts",
-          "line": 223
+          "line": 224
         },
         "parameters": [
           {
@@ -74329,7 +74419,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/azure-roledefinition/lib/role-definition.ts",
-        "line": 194
+        "line": 195
       },
       "methods": [
         {
@@ -74339,7 +74429,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 272
+            "line": 273
           },
           "name": "apiSchema",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -74358,7 +74448,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 313
+            "line": 314
           },
           "name": "createResourceBody",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -74384,7 +74474,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 257
+            "line": 258
           },
           "name": "defaultVersion",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -74403,7 +74493,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 285
+            "line": 286
           },
           "name": "resolveName",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -74429,7 +74519,7 @@
           },
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 264
+            "line": 265
           },
           "name": "resourceType",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -74451,7 +74541,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 208
+            "line": 209
           },
           "name": "idOutput",
           "type": {
@@ -74465,7 +74555,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 209
+            "line": 210
           },
           "name": "nameOutput",
           "type": {
@@ -74480,7 +74570,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 205
+            "line": 206
           },
           "name": "props",
           "type": {
@@ -74495,7 +74585,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 334
+            "line": 335
           },
           "name": "resourceId",
           "overrides": "@microsoft/terraform-cdk-constructs.core_azure.AzapiResource",
@@ -74511,7 +74601,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 341
+            "line": 342
           },
           "name": "roleName",
           "type": {
@@ -74526,7 +74616,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 348
+            "line": 349
           },
           "name": "roleType",
           "type": {
@@ -74547,7 +74637,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roledefinition/lib/role-definition.ts",
-        "line": 169
+        "line": 170
       },
       "name": "RoleDefinitionBody",
       "namespace": "azure_roledefinition",
@@ -74561,7 +74651,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 173
+            "line": 174
           },
           "name": "properties",
           "type": {
@@ -74693,7 +74783,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/azure-roledefinition/lib/role-definition.ts",
-        "line": 138
+        "line": 139
       },
       "name": "RoleDefinitionProperties",
       "namespace": "azure_roledefinition",
@@ -74707,7 +74797,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 162
+            "line": 163
           },
           "name": "assignableScopes",
           "type": {
@@ -74728,7 +74818,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 157
+            "line": 158
           },
           "name": "permissions",
           "type": {
@@ -74749,7 +74839,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 142
+            "line": 143
           },
           "name": "roleName",
           "type": {
@@ -74765,7 +74855,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 147
+            "line": 148
           },
           "name": "description",
           "optional": true,
@@ -74782,7 +74872,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 152
+            "line": 153
           },
           "name": "type",
           "optional": true,
@@ -74816,14 +74906,14 @@
         {
           "abstract": true,
           "docs": {
-            "example": "[\"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-name\"]",
+            "example": "[\"/providers/Microsoft.Management/managementGroups/my-mg\"]",
             "stability": "stable",
             "summary": "An array of scopes where this role can be assigned Can include subscription, resource group, or management group scopes Required property."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 125
+            "line": 126
           },
           "name": "assignableScopes",
           "type": {
@@ -74902,7 +74992,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/azure-roledefinition/lib/role-definition.ts",
-            "line": 131
+            "line": 132
           },
           "name": "ignoreChanges",
           "optional": true,
@@ -110879,6 +110969,6 @@
   "usedFeatures": [
     "class-covariant-overrides"
   ],
-  "version": "1.6.0",
-  "fingerprint": "NswjK2VbrWieF2CKHCRXT9O6U9ME2BHA4Q0G+FKLUxE="
+  "version": "1.7.1",
+  "fingerprint": "Kw0J/FZOkPTbuxzpQHvrI3R6N39mSD/CkiRq0NCA+ZI="
 }