Azure managed identity has administrative privileges over resources

azure

Set up the azure integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Azure role assignments should be restricted to the least level of privilege required to perform the duties required. The scope of the role assignment should be limited to the specific subscription, management, or resource group where these duties will take place. This rule identifies when a User has administrative level permissions at the root (most permissive) scope.

Rationale

Administrative Azure role assignments at the root scope have permissions on every Azure resource within a tenant, including all child management groups and subscriptions. This is the widest possible scope and is rarely needed. A role with these privileges could potentially, whether unknowingly or purposefully, cause security issues or data leaks. Roles with these levels of access may also be targeted by an adversary to compromise resources across the entire Azure tenant.

Remediation

Datadog recommends reducing the permissions and scope of a role assignment to the minimum necessary.