arm-mg-addroledefinition.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {},
  "variables": {
    "kvARMDeploymentOperatorRoleId": "[guid('customRole-kv-arm-deployment-operator')]"
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleDefinitions",
      "name": "[variables('kvARMDeploymentOperatorRoleId')]",
      "apiVersion": "2017-05-01",
      "dependsOn": [],
      "properties": {
        "roleName": "Key Vault resource manager template deployment operator",
        "id": "[variables('kvARMDeploymentOperatorRoleId')]",
        "IsCustom": true,
        "description": "Lets you deploy a resource manager template with the access to the secrets in the Key Vault.",
        "permissions": [
          {
            "actions": [
              "Microsoft.KeyVault/vaults/deploy/action"
            ],
            "notActions": []
          }
        ],
        "assignableScopes": [
          "[subscription().id]",
          "[concat('providers/Microsoft.Management/managementGroups/', subscription().tenantId)]"
        ]
      }
    }
  ]
}