fix: ensure role is idempotent and supports check mode

fix: ensure role is idempotent and supports check mode #170