APPSEC-1088: S6385 Improve RSPEC (#3092)

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: Loris S. <91723853+loris-s-sonarsource@users.noreply.github.com>
This commit is contained in:
daniel-teuchert-sonarsource 2023-09-20 14:45:38 +02:00 committed by GitHub
parent ae2e610d5c
commit 14dbf9d5f3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 4 deletions

View File

@ -101,8 +101,9 @@ resource roleDef 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
=== Going the extra mile
Here is a list of recommendations that can be followed regarding good usages of roles:
* Apply the least privilege principle by creating a custom role with as few permissions as possible.
* As custom role can be updated, gradually add atomic permissions when required.
* As custom roles can be updated, gradually add atomic permissions when required.
* Limit the assignable scopes of the custom role to a set of Resources or Ressource Groups.
* When necessary, use the built-in Owner role instead of a custom role granting subscription owner capabilities.
* Limit the assignments of Owner roles to less than three people or service principals.

View File

@ -1,5 +1,5 @@
Defining a custom role for a Subscription or a Management group that allows all actions will give them the same capabilities as the built-in Owner role.
It's recommended to limit the number of subscription owners in order to mitigate the risk of being breached by a compromised owner.
This rule raises an issue when a custom role has an assignable scope set to a Subscription or a Management Group and allows all actions (``++*++``)
¨
This rule raises an issue when a custom role has an assignable scope set to a Subscription or a Management Group and allows all actions (``++*++``).
To reduce the risk of intrusion of a compromised owner, it is recommended to limit the number of subscription owners.