> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Principals That Can Modify Infrastructure

### More Info:

Identifies principals whose role assignments let them create, change or delete resources - compute, networking, storage and the subscriptions own policy and access controls. Write access held at subscription or resource-group scope is what turns one compromised identity into an outage or a lasting foothold. Assign write roles at the narrowest scope that works and leave everything else on reader roles.

### Risk Level

High

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of "Principals with Infrastructure modification capabilities" in Azure using the Azure console, follow these step-by-step instructions:

        1. Sign in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) using your Azure account credentials.

        2. Navigate to the Azure Active Directory (AAD) service by clicking on the "Azure Active Directory" option in the left-hand menu.

        3. In the Azure Active Directory overview page, click on the "Security" tab in the left-hand menu.

        4. Under the "Security" tab, click on the "Azure AD Identity Governance" option.

        5. In the Azure AD Identity Governance page, click on the "Privileged Identity Management" option.

        6. In the Privileged Identity Management page, click on the "Azure resources" tab.

        7. You will see a list of Azure resources with their respective owners and roles. Identify the principals (users or groups) that have "Infrastructure modification capabilities" assigned to them.

        8. To remediate the misconfiguration, you have two options:

           a. Remove the "Infrastructure modification capabilities" assignment:

           * Click on the principal's name or email address.
           * In the principal's details page, click on the "Remove Assignment" button next to the "Infrastructure modification capabilities" role.
           * Confirm the removal when prompted.

           b. Review and modify the "Infrastructure modification capabilities" assignment:

           * Click on the principal's name or email address.
           * In the principal's details page, review the "Infrastructure modification capabilities" role assignment.
           * Modify the assignment as per your organization's security policies and requirements.
           * Click on the "Save" button to apply the changes.

        9. Repeat steps 7 and 8 for all principals that have the "Infrastructure modification capabilities" assigned.

        By following these steps, you will be able to remediate the misconfiguration of "Principals with Infrastructure modification capabilities" in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration related to "Principals with Infrastructure modification capabilities" in Azure using Azure CLI, follow these step-by-step instructions:

        1. Install Azure CLI: If you haven't already, install the Azure CLI on your local machine by following the official documentation ([https://docs.microsoft.com/en-us/cli/azure/install-azure-cli](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)).

        2. Authenticate with Azure: Open the command prompt or terminal and authenticate with your Azure account by running the following command:
           ```
           az login
           ```

        3. Select the Azure subscription: If you have multiple Azure subscriptions, select the appropriate one using the following command:
           ```
           az account set --subscription <subscription_id>
           ```

        4. List existing role assignments: To identify the principals with infrastructure modification capabilities, list the existing role assignments using the following command:

           ```
           az role assignment list --all
           ```

           Review the output to identify any roles that grant excessive permissions to principals.

        5. Revoke unnecessary role assignments: Determine the role assignments that need to be revoked based on the principle of least privilege. Use the following command to revoke a role assignment:

           ```
           az role assignment delete --assignee <principal_id> --role <role_name> --scope <resource_scope>
           ```

           Replace `<principal_id>` with the ID of the principal you want to revoke the role from, `<role_name>` with the name of the role you want to revoke, and `<resource_scope>` with the appropriate scope (e.g., resource group, subscription, etc.).

           Repeat this command for each unnecessary role assignment you identified in step 4.

        6. Verify the remediation: To ensure that the role assignments have been successfully revoked, list the role assignments again using the command from step 4.

           Confirm that the principals with infrastructure modification capabilities are no longer listed.

        By following these steps, you will be able to remediate the misconfiguration related to "Principals with Infrastructure modification capabilities" in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of "Principals with Infrastructure modification capabilities" in Azure using Python, follow these steps:

        1. Install the required Python libraries:
           ```python theme={null}
           pip install azure-identity
           pip install azure-mgmt-resource
           ```

        2. Import the necessary modules in your Python script:
           ```python theme={null}
           from azure.identity import DefaultAzureCredential
           from azure.mgmt.resource import ResourceManagementClient
           ```

        3. Authenticate to Azure using the DefaultAzureCredential:
           ```python theme={null}
           credential = DefaultAzureCredential()
           ```

        4. Create an instance of the ResourceManagementClient using the authenticated credential:
           ```python theme={null}
           subscription_id = "<your-subscription-id>"
           resource_client = ResourceManagementClient(credential, subscription_id)
           ```

        5. Retrieve the list of role assignments that have "Contributor" or other infrastructure modification capabilities:
           ```python theme={null}
           role_assignments = resource_client.role_assignments.list(filter="roleDefinitionId eq '/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7'")  # Contributor role definition ID
           ```

        6. Iterate through the role assignments and remove the ones that have "Contributor" or other infrastructure modification capabilities:
           ```python theme={null}
           for role_assignment in role_assignments:
               resource_client.role_assignments.delete(role_assignment.name)
           ```

        7. Once the role assignments are deleted, the principals will no longer have infrastructure modification capabilities.

        Make sure to replace `<your-subscription-id>` with your actual Azure subscription ID in step 4. Additionally, you can modify the role definition ID in step 5 to target different roles with infrastructure modification capabilities.

        Note: This solution assumes you have the necessary permissions to delete role assignments.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Azure AD user (principal) – leave as-is; misconfiguration is in its role assignments
        resource "azuread_user" "IAM_USER" {
          user_principal_name = "USER_UPN@example.com" # replace with actual UPN
          display_name        = "IAM User Display Name" # replace as needed
        }

        # Narrow-scoped role assignment with read-only access
        # Replace SUBSCRIPTION_ID / RESOURCE_GROUP_NAME / SCOPE_RESOURCE_ID as appropriate
        data "azurerm_subscription" "current" {
        }

        resource "azurerm_role_assignment" "iam_user_reader_narrow_scope" {
          scope                = "/subscriptions/${data.azurerm_subscription.current.subscription_id}/resourceGroups/RESOURCE_GROUP_NAME" # narrowest scope that works
          role_definition_name = "Reader"
          principal_id         = azuread_user.IAM_USER.object_id
        }

        # Example of a broad write role assignment that SHOULD BE REMOVED from Terraform
        # (If you currently have something like this, delete or modify it to the narrow Reader above)
        # resource "azurerm_role_assignment" "iam_user_contributor_subscription" {
        #   scope                = "/subscriptions/${data.azurerm_subscription.current.subscription_id}"
        #   role_definition_name = "Contributor"
        #   principal_id         = azuread_user.IAM_USER.object_id
        # }

        # NOTES:
        # - To remediate, ensure any existing assignment giving write permissions at subscription
        #   or wide resource-group scope (e.g., Owner, Contributor, User Access Administrator)
        #   is removed from Terraform or changed to:
        #     * a narrower `scope`, and/or
        #     * a read-only role like "Reader".
        # - Changing `scope` or `role_definition_name` on `azurerm_role_assignment` forces replacement
        #   of the role assignment, which briefly removes the old permission before adding the new one.

        # Verification:
        # `terraform plan` should show any broad write role assignments for this user
        # as either:
        #   - destroyed (if you removed them), or
        #   - replaced with a new `azurerm_role_assignment` at a narrower scope and/or with "Reader".
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>