Resource Locking Administrator Role
More Info:
Ensure there is a custom IAM role assigned to manage resource locking within each Microsoft Azure subscription. Azure resource locking is a powerful protection mechanism that can prevent inadvertent modification or deletion of resources running within a Azure cloud accountRisk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Resource Locking Administrator Role” misconfiguration in Azure using the Azure console, follow these steps:
- Log in to the Azure portal (https://portal.azure.com/)
- Click on “Azure Active Directory” from the left-hand menu.
- Click on “Roles and administrators” under “Security”.
- Click on “Add role assignment”.
- In the “Add role assignment” blade, select “Resource Lock Contributor” from the “Role” drop-down menu.
- In the “Select” field, search for the user or group that needs the Resource Lock Contributor role.
- Select the user or group from the search results.
- Click on “Save” to assign the Resource Lock Contributor role to the selected user or group.
Using CLI
Using CLI
To remediate the “Resource Locking Administrator Role” misconfiguration in Azure using Azure CLI, follow these steps:
- Open the Azure CLI and log in to your Azure account.
- Identify the scope of the Azure resource group or resource that needs to be locked.
-
Create a new role assignment for the Resource Locking Administrator role using the following command:
az role assignment create --role "Resource Locking Administrator" --assignee <object ID or email address> --scope <resource group or resource ID>Replace<object ID or email address>with the email address or object ID of the user or group you want to assign the role to, and replace<resource group or resource ID>with the ID of the resource group or resource you want to lock. -
Verify that the role assignment was created successfully by running the following command:
az role assignment list --role "Resource Locking Administrator" --allThis command will list all role assignments that have the Resource Locking Administrator role assigned to them. - Test the resource locking by attempting to delete the locked resource or modify its properties. You should receive an error message indicating that the resource is locked.
Using Python
Using Python
To remediate the “Resource Locking Administrator Role” misconfiguration in Azure using Python, you can follow the below steps:By following these steps, you can remediate the “Resource Locking Administrator Role” misconfiguration in Azure using Python.
- Install the Azure SDK for Python using pip:
- Authenticate with Azure using your credentials:
- Retrieve the Resource Locking Administrator Role:
- If the role does not exist, create it:
- Assign the role to the appropriate user or group: