APPSEC-1088: S6385 Improve RSPEC (#3092)
## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule) --------- Co-authored-by: Loris S. <91723853+loris-s-sonarsource@users.noreply.github.com>
This commit is contained in:
parent
ae2e610d5c
commit
14dbf9d5f3
@ -101,8 +101,9 @@ resource roleDef 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
|
||||
=== Going the extra mile
|
||||
|
||||
Here is a list of recommendations that can be followed regarding good usages of roles:
|
||||
|
||||
* Apply the least privilege principle by creating a custom role with as few permissions as possible.
|
||||
* As custom role can be updated, gradually add atomic permissions when required.
|
||||
* As custom roles can be updated, gradually add atomic permissions when required.
|
||||
* Limit the assignable scopes of the custom role to a set of Resources or Ressource Groups.
|
||||
* When necessary, use the built-in Owner role instead of a custom role granting subscription owner capabilities.
|
||||
* Limit the assignments of Owner roles to less than three people or service principals.
|
||||
|
@ -1,5 +1,5 @@
|
||||
Defining a custom role for a Subscription or a Management group that allows all actions will give them the same capabilities as the built-in Owner role.
|
||||
It's recommended to limit the number of subscription owners in order to mitigate the risk of being breached by a compromised owner.
|
||||
|
||||
This rule raises an issue when a custom role has an assignable scope set to a Subscription or a Management Group and allows all actions (``++*++``)
|
||||
¨
|
||||
This rule raises an issue when a custom role has an assignable scope set to a Subscription or a Management Group and allows all actions (``++*++``).
|
||||
|
||||
To reduce the risk of intrusion of a compromised owner, it is recommended to limit the number of subscription owners.
|
Loading…
x
Reference in New Issue
Block a user