https://hardstl.github.io/posts/azure-role-assignments-with-constraints/