770348d041
* Add check for security standard mismatch * Fix security standard mismatches * Fix Resources/Standards links for secrets rules * Fix check * Fix links and update security standard mapping * Fix maintanability issue * Apply review suggestions * Apply suggestions from code review Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com> * Fix typo Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com> --------- Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
91 lines
2.9 KiB
Plaintext
91 lines
2.9 KiB
Plaintext
Azure Active Directory offers built-in roles that can be assigned to users, groups, or service principals.
|
|
Some of these roles should be carefully assigned as they grant sensitive permissions like the ability to reset passwords for all users.
|
|
|
|
An Azure account that fails to limit the use of such roles has a higher risk of being breached by a compromised owner.
|
|
|
|
This rule raises an issue when one of the following roles is assigned:
|
|
|
|
* Application Administrator
|
|
* Authentication Administrator
|
|
* Cloud Application Administrator
|
|
* Global Administrator
|
|
* Groups Administrator
|
|
* Helpdesk Administrator
|
|
* Password Administrator
|
|
* Privileged Authentication Administrator
|
|
* Privileged Role Administrator
|
|
* User Administrator
|
|
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* The user, group, or service principal doesn't use the entirety of this extensive set of permissions to operate on a day-to-day basis.
|
|
* It is possible to follow the Separation of Duties principle and split permissions between multiple users, but it's not enforced.
|
|
|
|
There is a risk if you answered yes to any of these questions.
|
|
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
* Limit the assignment of Global Administrator roles to less than five people or service principals.
|
|
* Apply the least privilege principle by choosing a role with a limited set of permissions.
|
|
* If no built-in role meets your needs, create a custom role with as few permissions as possible.
|
|
|
|
|
|
== Sensitive Code Example
|
|
[source,terraform]
|
|
----
|
|
resource "azuread_directory_role" "example" {
|
|
display_name = "Privileged Role Administrator" # Sensitive
|
|
}
|
|
|
|
resource "azuread_directory_role_member" "example" {
|
|
role_object_id = azuread_directory_role.example.object_id
|
|
member_object_id = data.azuread_user.example.object_id
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
[source,terraform]
|
|
----
|
|
resource "azuread_directory_role" "example" {
|
|
display_name = "Usage Summary Reports Reader"
|
|
}
|
|
|
|
resource "azuread_directory_role_member" "example" {
|
|
role_object_id = azuread_directory_role.example.object_id
|
|
member_object_id = data.azuread_user.example.object_id
|
|
}
|
|
----
|
|
|
|
== See
|
|
|
|
* CWE - https://cwe.mitre.org/data/definitions/79[CWE-266 - Incorrect Privilege Assignment]
|
|
* https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference[Azure AD Documentation] - Azure AD built-in roles
|
|
* https://docs.microsoft.com/en-us/azure/active-directory/roles/best-practices[Azure AD Documentation] - Best practices for Azure AD roles
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* Primary location
|
|
** Make sure that assigning the {role_name} role is safe here.
|
|
* Secondary location
|
|
** Role assigned here.
|
|
|
|
|
|
|
|
=== Highlighting
|
|
|
|
* Primary location
|
|
** ``++azuread_directory_role.display_name++`` or ``++azuread_directory_role.template_id++`` assignment
|
|
* Secondary locations
|
|
** ``++azuread_directory_role_member.role_object_id++`` assignment
|
|
|
|
|
|
endif::env-github,rspecator-view[] |