rules/findings/azure/IAM/subscription-privileged-role-assignments-are-reviewed.json
|
{
"provider": "Azure", "serviceType": "Subscription Identity", "serviceName": "Subscription", "displayName": "Ensure that all 'privileged' role assignments are periodically reviewed", "description": "Periodic review of privileged role assignments is performed to ensure that the privileged roles assigned to users are accurate and appropriate.", "rationale": "Privileged roles are crown jewel assets that can be used by malicious insiders, threat actors, and even through mistake to significantly damage an organization in numerous ways. These roles should be periodically reviewed to:\n• identify lingering permissions assignment (e.g. an administrator has been terminated, the administrator account is being retained, but the permissions are no longer necessary and has not been properly addressed by process)\n• detect lateral movement through privilege escalation (e.g. an account with administrative permission has been compromised and is elevating other accounts in an attempt to circumvent detection mechanisms)", "impact": "Increased administrative effort to manage and remove role assignments appropriately.", "remediation": { "text": "", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "6.0.0", "reference": "5.3.4", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "az_role_assignment", "subPath": null, "selectCondition": {}, "data": { "properties": { "effectiveUsers.*": null, "name": "roleName", "description": "roleDescription", "isBuiltIn": "isBuiltIn", "roleType": "roleType", "assignableScopes": "assignableScopes", "templateId": "templateId" }, "expandObject": "effectiveUsers" }, "query": [ { "filter": [ { "include": "_ARG_0_" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "Id", "userPrincipalName": "userPrincipalName", "roleName": "Role", "roleDescription": "Role Description" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "userPrincipalName", "roleName", "roleDescription" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "Id", "userPrincipalName": "userPrincipalName", "roleName": "Role", "roleDescription": "Role Description" }, "expandObject": null }, "status": { "keyName": [ "userPrincipalName", "roleName" ], "message": "Ensure that {roleName} privileged role is periodically reviewed for {userPrincipalName}", "defaultMessage": null }, "properties": { "resourceName": "userPrincipalName", "resourceId": "id", "resourceType": "@odata.type" }, "onlyStatus": false } }, "idSuffix": "azure_privileged_assignments_are_reviewed", "notes": [], "categories": [], "immutable_properties": [ "id" ], "id": "" } |