{
  "Name": "CertifyClouds Replication - Source",
  "IsCustom": true,
  "Description": "Least-privilege data actions for the CertifyClouds replication engine to read secrets, certificates, and keys from a source Azure Key Vault. Replace the AssignableScopes value with your subscription ID before running `az role definition create`.",
  "Actions": [],
  "NotActions": [],
  "DataActions": [
    "Microsoft.KeyVault/vaults/secrets/getSecret/action",
    "Microsoft.KeyVault/vaults/certificates/get/action",
    "Microsoft.KeyVault/vaults/keys/backup/action"
  ],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/00000000-0000-0000-0000-000000000000"
  ]
}