> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Resource Locking Administrator Role

### More Info:

Ensure there is a custom IAM role assigned to manage resource locking within each Microsoft Azure subscription. Azure resource locking is a powerful protection mechanism that can prevent inadvertent modification or deletion of resources running within a Azure cloud account

### Risk Level

Medium

### Address

Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Resource Locking Administrator Role" misconfiguration in Azure using the Azure console, follow these steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/))
        2. Click on "Azure Active Directory" from the left-hand menu.
        3. Click on "Roles and administrators" under "Security".
        4. Click on "Add role assignment".
        5. In the "Add role assignment" blade, select "Resource Lock Contributor" from the "Role" drop-down menu.
        6. In the "Select" field, search for the user or group that needs the Resource Lock Contributor role.
        7. Select the user or group from the search results.
        8. Click on "Save" to assign the Resource Lock Contributor role to the selected user or group.

        By assigning the Resource Lock Contributor role to the appropriate user or group, you can ensure that they have the necessary permissions to create and manage resource locks in Azure. This will help prevent accidental deletion or modification of critical resources.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI and log in to your Azure account.

        2. Identify the scope of the Azure resource group or resource that needs to be locked.

        3. Create a new role assignment for the Resource Locking Administrator role using the following command:

           `az role assignment create --role "Resource Locking Administrator" --assignee <object ID or email address> --scope <resource group or resource ID>`

           Replace `<object ID or email address>` with the email address or object ID of the user or group you want to assign the role to, and replace `<resource group or resource ID>` with the ID of the resource group or resource you want to lock.

        4. Verify that the role assignment was created successfully by running the following command:

           `az role assignment list --role "Resource Locking Administrator" --all`

           This command will list all role assignments that have the Resource Locking Administrator role assigned to them.

        5. Test the resource locking by attempting to delete the locked resource or modify its properties. You should receive an error message indicating that the resource is locked.

        By following these steps, you can remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Python, you can follow the below steps:

        1. Install the Azure SDK for Python using pip:

        ```
        pip install azure-mgmt-resource
        ```

        2. Authenticate with Azure using your credentials:

        ```python theme={null}
        from azure.common.credentials import UserPassCredentials
        from azure.mgmt.resource import ResourceManagementClient

        # Replace the values with your credentials
        subscription_id = 'your-subscription-id'
        username = 'your-username'
        password = 'your-password'
        tenant_id = 'your-tenant-id'

        credentials = UserPassCredentials(username, password, tenant_id)
        resource_client = ResourceManagementClient(credentials, subscription_id)
        ```

        3. Retrieve the Resource Locking Administrator Role:

        ```python theme={null}
        role_name = 'Resource Locking Administrator'

        roles = resource_client.role_definitions.list()
        role_definition = next((r for r in roles if r.name == role_name), None)
        ```

        4. If the role does not exist, create it:

        ```python theme={null}
        if not role_definition:
            role_definition = resource_client.role_definitions.create_or_update(
                scope='/subscriptions/' + subscription_id,
                role_definition_name=role_name,
                role_definition={
                    'Name': role_name,
                    'IsCustom': False,
                    'Description': 'Allows management of resource locks.',
                    'Actions': [
                        'Microsoft.Authorization/*/read',
                        'Microsoft.Authorization/locks/*'
                    ],
                    'NotActions': [],
                    'AssignableScopes': ['/subscriptions/' + subscription_id]
                }
            )
        ```

        5. Assign the role to the appropriate user or group:

        ```python theme={null}
        principal_id = 'your-principal-id' # replace with the principal ID of the user or group you want to assign the role to

        assignment_name = 'Resource Locking Administrator Assignment'
        assignment_scope = '/subscriptions/' + subscription_id

        assignment = resource_client.role_assignments.create(
            scope=assignment_scope,
            role_assignment_name=assignment_name,
            role_assignment_parameters={
                'role_definition_id': role_definition.id,
                'principal_id': principal_id
            }
        )
        ```

        By following these steps, you can remediate the "Resource Locking Administrator Role" misconfiguration in Azure using Python.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>