Publicly accessible Azure VM with high or critical vulnerabilities has an assigned managed identity with administrator-equivalent RBAC rights

azure.compute
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

A publicly accessible Azure VM has one or more open high or critical severity vulnerabilities and an assigned managed identity with administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. If the VM is compromised, an attacker could use the managed identity to control resources and security settings within that scope.

Remediation

  1. Apply security updates to remediate the vulnerability and restrict public network access to the virtual machine. See Guest updates and host maintenance and Azure network security groups.
  2. Remove administrator-equivalent role assignments from the managed identity and grant only the permissions required by the workload. See Remove Azure role assignments.