Ensure Owner roles are not assigned to any principal using Azure Role Assignment

HIGH

Description

Azure Role Assignment has Owner role assigned, this can lead to privilege escalation if an adversary takes over the principal(user, group, or service principal).

Remediation

In Azure Console -

  1. Open the Azure Portal and go to Active Directory.
  2. Select the user you wish to edit.
  3. Under Manage, select Assigned roles.
  4. Remove any assignment for the Owner role.

In Terraform -

  1. In the azurerm_role_assignment resource, update the role_definition_name to something other than Owner.

References:
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment

Policy Details

Rule Reference ID: AC_AZURE_0282
CSP: Azure
Remediation Available: Yes
Resource Type: Policy

Frameworks