Trigger: Detect & correct Subscriptions with custom owner roles

select
  concat(id, ' [', subscription_id, '/', role_name, ']') as title,
  id as id,
  role_name as name,
  subscription_id,
  _ctx ->> 'connection_name' as conn
from
  azure_role_definition,
  jsonb_array_elements(permissions) as s,
  jsonb_array_elements_text(s -> 'actions') as action
where
  role_type = 'CustomRole'
  and action in ('*', '*:*');