When specified, this role is assumed to be a client role belonging to the client with the provided ID. The id attribute of a keycloak_client resource should be used here.
id
keycloak_client