Resource Locking Administrator Role

More Info:

Ensure there is a custom IAM role assigned to manage resource locking within each Microsoft Azure subscription. Azure resource locking is a powerful protection mechanism that can prevent inadvertent modification or deletion of resources running within a Azure cloud account

Risk Level

Medium

Address

Security

Compliance Standards

• Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the "Resource Locking Administrator Role" misconfiguration in Azure using the Azure console, follow these steps:

1. Log in to the Azure portal (https://portal.azure.com/)
2. Click on "Azure Active Directory" from the left-hand menu.
3. Click on "Roles and administrators" under "Security".
4. Click on "Add role assignment".
5. In the "Add role assignment" blade, select "Resource Lock Contributor" from the "Role" drop-down menu.
6. In the "Select" field, search for the user or group that needs the Resource Lock Contributor role.
7. Select the user or group from the search results.
8. Click on "Save" to assign the Resource Lock Contributor role to the selected user or group.

By assigning the Resource Lock Contributor role to the appropriate user or group, you can ensure that they have the necessary permissions to create and manage resource locks in Azure. This will help prevent accidental deletion or modification of critical resources.

Using CLI

To remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Azure CLI, follow these steps:

1. Open the Azure CLI and log in to your Azure account.

2. Identify the scope of the Azure resource group or resource that needs to be locked.

3. Create a new role assignment for the Resource Locking Administrator role using the following command:

   az role assignment create --role "Resource Locking Administrator" --assignee <object ID or email address> --scope <resource group or resource ID>

   Replace <object ID or email address> with the email address or object ID of the user or group you want to assign the role to, and replace <resource group or resource ID> with the ID of the resource group or resource you want to lock.

4. Verify that the role assignment was created successfully by running the following command:

   az role assignment list --role "Resource Locking Administrator" --all

   This command will list all role assignments that have the Resource Locking Administrator role assigned to them.

5. Test the resource locking by attempting to delete the locked resource or modify its properties. You should receive an error message indicating that the resource is locked.

By following these steps, you can remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Azure CLI.

Using Python

To remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Python, you can follow the below steps:

1. Install the Azure SDK for Python using pip:

pip install azure-mgmt-resource

2. Authenticate with Azure using your credentials:

from azure.common.credentials import UserPassCredentials
from azure.mgmt.resource import ResourceManagementClient

# Replace the values with your credentials
subscription_id = 'your-subscription-id'
username = 'your-username'
password = 'your-password'
tenant_id = 'your-tenant-id'

credentials = UserPassCredentials(username, password, tenant_id)
resource_client = ResourceManagementClient(credentials, subscription_id)

3. Retrieve the Resource Locking Administrator Role:

role_name = 'Resource Locking Administrator'

roles = resource_client.role_definitions.list()
role_definition = next((r for r in roles if r.name == role_name), None)

4. If the role does not exist, create it:

if not role_definition:
    role_definition = resource_client.role_definitions.create_or_update(
        scope='/subscriptions/' + subscription_id,
        role_definition_name=role_name,
        role_definition={
            'Name': role_name,
            'IsCustom': False,
            'Description': 'Allows management of resource locks.',
            'Actions': [
                'Microsoft.Authorization/*/read',
                'Microsoft.Authorization/locks/*'
            ],
            'NotActions': [],
            'AssignableScopes': ['/subscriptions/' + subscription_id]
        }
    )

5. Assign the role to the appropriate user or group:

principal_id = 'your-principal-id' # replace with the principal ID of the user or group you want to assign the role to

assignment_name = 'Resource Locking Administrator Assignment'
assignment_scope = '/subscriptions/' + subscription_id

assignment = resource_client.role_assignments.create(
    scope=assignment_scope,
    role_assignment_name=assignment_name,
    role_assignment_parameters={
        'role_definition_id': role_definition.id,
        'principal_id': principal_id
    }
)

By following these steps, you can remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Python.

Using Terraform

# Custom role definition for managing Azure resource locks at subscription scope
resource "azurerm_role_definition" "resource_locking_administrator" {
  name        = "RESOURCE_LOCKING_ADMINISTRATOR_ROLE_NAME" # e.g. "Resource Locking Administrator"
  scope       = "/subscriptions/SUBSCRIPTION_ID"           # replace with your subscription ID
  description = "Custom role to manage Azure resource locks within the subscription."

  permissions {
    actions = [
      # Full control over management locks
      "Microsoft.Authorization/locks/*",

      # Read access to resources so the operator can see what they are locking
      "Microsoft.Resources/subscriptions/resourceGroups/read",
      "Microsoft.Resources/subscriptions/resourceGroups/resources/read",
    ]

    not_actions = []
  }

  assignable_scopes = [
    "/subscriptions/SUBSCRIPTION_ID", # same as scope above
  ]
}

# Assign the custom role to a user, group, or service principal that will manage locks
resource "azurerm_role_assignment" "resource_locking_administrator_assignment" {
  scope                = "/subscriptions/SUBSCRIPTION_ID"          # where the role applies
  role_definition_id   = azurerm_role_definition.resource_locking_administrator.role_definition_resource_id
  principal_id         = "PRINCIPAL_OBJECT_ID"                     # object ID of the user/group/service principal
  principal_type       = "ServicePrincipal"                         # or "User" / "Group" as appropriate
}

Substitute:

• SUBSCRIPTION_ID with the target Azure subscription ID.
• RESOURCE_LOCKING_ADMINISTRATOR_ROLE_NAME with your desired custom role name.
• PRINCIPAL_OBJECT_ID with the Azure AD object ID of the identity that should manage locks.
• principal_type with the correct type for that identity.

Changing permissions or assignable_scopes on azurerm_role_definition forces replacement of the custom role (and may briefly break assignments) but does not delete any existing locks.

To verify, terraform plan should show:

• azurerm_role_definition.resource_locking_administrator to be created.
• azurerm_role_assignment.resource_locking_administrator_assignment to be created.