raff_role

resource "raff_role" "auditor" {
  name        = "Auditor"
  slug        = "auditor"
  scope       = "account"
  description = "Read-only access for compliance reviews"

  permissions = [
    "account.audit.read",
    "billing.read",
    "members.read",
  ]
}

resource "raff_role" "vm_operator" {
  name  = "VM Operator"
  slug  = "vm-operator"
  scope = "project"

  permissions = [
    "vm.read",
    "vm.power",
  ]
}

terraform import raff_role.auditor <role-uuid>

# Single role by UUID
data "raff_role" "owner" {
  id = "<role-uuid>"
}

# All roles, optionally filtered by scope
data "raff_roles" "account" {
  scope = "account"
}