Policy Setting: Azure > IAM > Role Definition > Approved

resource "turbot_policy_setting" "azure_iam_role_definition_approved" {
  resource = turbot_policy_pack.main.id
  type     = "tmod:@turbot/azure-iam#/policy/types/roleDefinitionApproved"
  note     = "Azure CIS v2.0.0 - Control: 1.23"
  value    = "Check: Approved"
  # value    = "Enforce: Delete unapproved"
}