Terraform apply should be reserved for the CD server and to approved pull-requests only. However
- Going through git push and then waiting on the job in to run in the background for every typo and mistake made when writing the definitions adds quite a bit of overhead to the already not exactly fast process.
- While moving can be done with the move statements, there is already quite a few resources created by hand in the portal that I want to coopt under terraform management, so running import is needed a lot.
So for sake of efficiency it would be nice if we could run terraform plan and terraform import locally, but still for comfort of the paranoid main administrator limit the damage that can be done without proper review.
Some things should probably work with subscription-wide Reader, but I know at least functionapp settings and contents of keyvaults (terraform is to take care of updating various access keys—it's important part of why going to terraform) can't be accessed with that, and I am not sure whether role assignments can (managed identities are to be used where practical).
What minimal set of roles should be granted to be able to import at least most things in Azure without asking anything too dangerous?