CreateTerraformRole.ps1

# This takes the Contributor role and creates a new Terraform Contributor role.
# It can do everything that the contributor can do but also create resource locks and assign roles for permissions to resources.

$subscriptionId = Read-Host -Prompt "Input the Subscription ID."
$subObj = Get-AzSubscription -SubscriptionId $subscriptionId

$role = Get-AzRoleDefinition -Name "Contributor"
$role.Name = "Terraform "+$subObj.Name+" Contributor"
$role.Description = "Adds the ability to Add Resource Locks to resources along with the normal Contributor actions."
$role.Actions.Add("Microsoft.Authorization/locks/*")
$role.NotActions.Remove("Microsoft.Authorization/*/Write")
$role.AssignableScopes.Clear()
$role.AssignableScopes.Add("/subscriptions/$subscriptionId")

New-AzRoleDefinition -Role $role