Role definition allows custom role creation

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-azure-role-definition-allows-custom-role-creation

Provider: Azure

Platform: Ansible

Severity: Medium

Category: Access Control

Learn More

Description

Role definitions must not grant the ability to create or modify other role definitions (Microsoft.Authorization/roleDefinitions/write). This capability enables privilege escalation and persistent unauthorized access by allowing creation of custom roles with elevated permissions.

In Ansible playbooks using the azure.azcollection.azure_rm_roledefinition or azure_rm_roledefinition modules, the permissions[].actions array must not include the literal action Microsoft.Authorization/roleDefinitions/write and must not be a wildcard (*). This rule flags tasks where permissions.actions is ["*"] or contains Microsoft.Authorization/roleDefinitions/write. Ensure the actions list contains only the specific, least-privilege actions required for the role.

Secure example with no role-definition write permission:

- name: example role
  azure.azcollection.azure_rm_roledefinition:
    name: customReadOnlyRole
    scope: /subscriptions/00000000-0000-0000-0000-000000000000
    permissions:
      - actions:
          - "Microsoft.Storage/storageAccounts/read"
          - "Microsoft.Compute/virtualMachines/read"

Compliant Code Examples

---
- name: Create a role definition3
  azure_rm_roledefinition:
    name: myTestRole3
    scope: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourceGroup
    permissions:
      - actions:
          - "Microsoft.Compute/virtualMachines/read"
        data_actions:
          - "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
    assignable_scopes:
      - "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

Non-Compliant Code Examples

---
- name: Create a role definition
  azure_rm_roledefinition:
    name: myTestRole
    scope: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourceGroup
    permissions:
      - actions:
          - "Microsoft.Authorization/roleDefinitions/write"
    assignable_scopes:
      - "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

---
- name: Create a role definition2
  azure_rm_roledefinition:
    name: myTestRole2
    scope: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myresourceGroup
    permissions:
      - actions:
          - "*"
    assignable_scopes:
      - "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"