> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure assume role remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration related to principals with assume role in Azure, follow these step-by-step instructions using the Azure console: 1. Log in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) using your Azure account credentials. 2. Navigate to the Azure Active Directory (AAD) service by clicking on the "Azure Active Directory" option in the left-hand side menu. 3. In the AAD dashboard, click on "Enterprise applications" under the "Manage" section in the left-hand side menu. 4. In the "Enterprise applications" page, search for the application that needs to be remediated. You can use the search bar at the top to find the application by name. 5. Click on the application to open its details page. 6. In the application details page, click on the "Single sign-on" option in the left-hand side menu. 7. Under the "Single sign-on" section, click on the "User assignment required" toggle switch to enable it. This will enforce user assignment for the application. 8. Once the "User assignment required" toggle switch is enabled, click on the "Save" button at the top of the page to save the changes. 9. Now, navigate to the "App registrations" section in the left-hand side menu of the AAD dashboard. 10. In the "App registrations" page, search for the application that needs to be remediated. You can use the search bar at the top to find the application by name. 11. Click on the application to open its details page. 12. In the application details page, click on the "API permissions" option in the left-hand side menu. 13. Under the "API permissions" section, review the permissions granted to the application. Remove any unnecessary or excessive permissions by clicking on the "Remove" button next to each permission. 14. After removing the unnecessary permissions, click on the "Save" button at the top of the page to save the changes. 15. Finally, navigate to the "Overview" section in the left-hand side menu of the AAD dashboard. 16. In the "Overview" section, click on the "Properties" option in the top menu. 17. Under the "Properties" section, review the settings and configurations for the application. Ensure that the appropriate settings are configured, such as multi-factor authentication, user assignment required, etc. 18. Make any necessary changes to the properties and click on the "Save" button at the top of the page to save the changes. By following these steps, you have successfully remediated the misconfiguration related to principals with assume role in Azure using the Azure console. # To remediate the misconfiguration of "Principals with Assume Role" in Azure using Azure CLI, follow these step-by-step instructions: 1. Install and set up Azure CLI: * Download and install Azure CLI from the official Microsoft documentation ([https://docs.microsoft.com/en-us/cli/azure/install-azure-cli](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)). * Once installed, open the Azure CLI command prompt or terminal. 2. Authenticate with Azure: * Run the following command to sign in to your Azure account: ``` az login ``` * Follow the on-screen instructions to complete the authentication process. 3. List the existing role assignments: * Run the following command to list all the existing role assignments in your Azure subscription: ``` az role assignment list ``` * Review the output to identify any principals with assume role misconfigurations. 4. Remove the misconfigured role assignments: * Identify the principal (user, group, or service principal) with the misconfigured assume role. * Run the following command to remove the misconfigured role assignment: ``` az role assignment delete --assignee --role --scope ``` Replace `` with the ID of the misconfigured principal, `` with the name of the role assigned to the principal, and `` with the scope where the misconfiguration exists (e.g., resource group, subscription, etc.). * Repeat this command for each misconfigured role assignment that needs to be removed. 5. Verify the remediation: * Run the `az role assignment list` command again to verify that the misconfigured role assignments have been successfully removed. * Ensure that the principals no longer have the ability to assume the role. By following these steps, you will be able to remediate the misconfiguration of "Principals with Assume Role" in Azure using Azure CLI. To remediate the misconfiguration related to principals with assume role in Azure IAM using Python, follow these steps: 1. Import the required libraries: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.authorization import AuthorizationManagementClient ``` 2. Authenticate to Azure using the Azure Identity library: ```python theme={null} credential = DefaultAzureCredential() ``` 3. Create an instance of the AuthorizationManagementClient: ```python theme={null} authorization_client = AuthorizationManagementClient(credential, subscription_id) ``` Note: Replace `subscription_id` with your Azure subscription ID. 4. Get the list of role assignments: ```python theme={null} role_assignments = authorization_client.role_assignments.list() ``` 5. Iterate through the role assignments and check if any principal has an "AssumeRole" type: ```python theme={null} for role_assignment in role_assignments: if role_assignment.principal_type == 'AssumeRole': # Remove the role assignment authorization_client.role_assignments.delete(role_assignment.name) ``` 6. Save and run the Python script to remediate the misconfiguration. These steps will use the Azure Identity and Authorization Management libraries in Python to authenticate to Azure and remove any role assignments with the "AssumeRole" principal type. ```hcl theme={null} # Principal (user) – replace with however you already manage this identity resource "azuread_user" "AZURE_IAM_USER" { user_principal_name = "USER_UPN@example.com" # replace with the actual UPN display_name = "USER_DISPLAY_NAME" # replace with a meaningful name } # BEFORE (to be removed): this is the kind of assignment that allows acting as other identities, # for example Owner / User Access Administrator / Managed Identity Operator, etc. # resource "azurerm_role_assignment" "AZURE_IAM_USER_IMPERSONATION" { # scope = "/SUBSCRIPTIONS/EXAMPLE" # replace with actual scope # role_definition_name = "User Access Administrator" # or "Owner", "Managed Identity Operator", etc. # principal_id = azuread_user.AZURE_IAM_USER.object_id # } # AFTER: keep only the least‑privileged role the user actually needs, or remove # the assignment entirely if no permissions are required at this scope. resource "azurerm_role_assignment" "AZURE_IAM_USER_ALLOWED_ROLE" { scope = "/SUBSCRIPTIONS/ACTUAL_SUBSCRIPTION_ID" # replace with the intended scope role_definition_name = "Reader" # replace with the least-privilege role you really want principal_id = azuread_user.AZURE_IAM_USER.object_id } ``` Changing the role on this principal from an impersonation-capable role (e.g., Owner, User Access Administrator, Managed Identity Operator) to a non-privileged role (or deleting the assignment entirely) removes its ability to act as another identity; changing a role assignment forces replacement of that role assignment resource (destroy/create) but does not restart workloads. For verification, `terraform plan` should show the old impersonation-capable `azurerm_role_assignment` being destroyed (or its `role_definition_name` changing) and only the intended least‑privileged assignment remaining for that user.