rspec/rules/S6383/terraform/rule.adoc

Disabling Role-Based Access Control (RBAC) on Azure resources can reduce an
organization's ability to protect itself against access controls being compromised.

To be considered safe, access controls must follow the principle of
least privilege and correctly segregate duties amongst users.
RBAC helps enforce these practices by adapting the organization's access control
needs into explicit role-based policies: It helps keeping access controls maintainable
and sustainable.

Furthermore, RBAC allows operations teams to work faster during a security
incident. It helps to mitigate account theft or intrusions by quickly shutting down
accesses.

== Ask Yourself Whether

* This Azure resource is essential for the information system infrastructure.
* This Azure resource is essential for mission-critical functions.
* Compliance policies require access to this resource to be enforced through the use of Role-Based Access Control.

There is a risk if you answered yes to any of those questions.

== Recommended Secure Coding Practices

* Enable Azure RBAC when the Azure resource supports it.
* For Kubernetes clusters, enable Azure RBAC if Azure AD integration is supported. Otherwise, use the built-in Kubernetes RBAC.

== Sensitive Code Example

For https://azure.microsoft.com/fr-fr/services/kubernetes-service/[Azure Kubernetes Services]:

----
resource "azurerm_kubernetes_cluster" "example" {
  role_based_access_control {
    enabled = false # Sensitive
  }
}

resource "azurerm_kubernetes_cluster" "example2" {
  role_based_access_control {
    enabled = true

    azure_active_directory {
      managed = true
      azure_rbac_enabled = false # Sensitive
    }
  }
}
----

For https://azure.microsoft.com/fr-fr/services/key-vault/[Key Vaults]:

----
resource "azurerm_key_vault" "example" {
  enable_rbac_authorization = false # Sensitive

}
----

== Compliant Solution

For https://azure.microsoft.com/fr-fr/services/kubernetes-service/[Azure Kubernetes Services]:

[source,terraform]
----
resource "azurerm_kubernetes_cluster" "example" {
  role_based_access_control {
    enabled = true
  }
}

resource "azurerm_kubernetes_cluster" "example" {
  role_based_access_control {
    enabled = true

    azure_active_directory {
      managed = true
      azure_rbac_enabled = true
    }
  }
}
----

For https://azure.microsoft.com/fr-fr/services/key-vault/[Key Vaults]:

[source,terraform]
----
resource "azurerm_key_vault" "example" {
  enable_rbac_authorization   = true

}
----

== See

* https://owasp.org/Top10/A01_2021-Broken_Access_Control/[OWASP Top 10 2021 Category A1] - Boken Access Control
* https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control[OWASP Top 10 2017 Category A5] - Broken Access Control
* https://cwe.mitre.org/data/definitions/668[MITRE, CWE-668] - Exposure of Resource to Wrong Sphere

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

* Omitting {parameter} disables role-based access control for this resource. Make sure it is safe here.
* Make sure that disabling role-based access control is safe here.

=== Highlighting

* If role_based_acccess_control is missing, highlight the resource
* If an assignment is non-compliant, highlight the entire assignment
* If an assignment is missing, highlight the block where it should be.


endif::env-github,rspecator-view[]