IAM User or Role with Privilege escalation
More Info:
IAM User or Role can be leveraged to escalate privileges and can present higher risk.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP,HIPAA,SCO2,NISTCSF,NIST,AWSWAF,ISO27001,HITRUSTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of an IAM user or role with privilege escalation in Azure, you can follow these step-by-step instructions using the Azure console:
- Sign in to the Azure portal (https://portal.azure.com) using your administrator account.
- Navigate to the “Azure Active Directory” service from the left-hand menu.
- In the Azure Active Directory overview page, select “Users” or “Roles” based on whether the misconfiguration is related to a user or a role.
- If the misconfiguration is related to a user, search for the affected user in the “Users” section and select it. If it is related to a role, go to the “Roles and administrators” section and select the affected role.
- In the user or role details page, review the assigned permissions and privileges.
- To remediate the privilege escalation, you have two options: a. Remove the user or role: If the user or role is not required, you can remove it by selecting the “Delete” or “Remove” option. Confirm the action when prompted. b. Modify the assigned permissions: If the user or role is required but has excessive permissions, you can modify the assigned permissions to reduce the privilege level. To do this, select the “Permissions” or “Assignments” tab in the user or role details page.
- In the permissions or assignments tab, review the existing permissions or assignments and identify the excessive or unnecessary ones.
- To modify the permissions or assignments, select the specific permission or assignment and choose the “Remove” or “Revoke” option. Confirm the action when prompted.
- Repeat step 8 for all the excessive or unnecessary permissions or assignments.
- Once you have removed or modified the necessary permissions or assignments, review the remaining permissions or assignments to ensure they align with the principle of least privilege.
- Save the changes and exit the user or role details page.
Using CLI
Using CLI
To remediate the IAM user or role with privilege escalation misconfiguration in Azure, you can follow these step-by-step instructions using Azure CLI:
- Install Azure CLI: If you haven’t already, install Azure CLI on your local machine by following the instructions provided by Microsoft for your operating system.
-
Authenticate with Azure: Open a terminal or command prompt and run the following command to sign in to Azure using Azure CLI:
-
List IAM users or roles: Run the following command to list all the IAM users and roles in your Azure subscription:
This command will provide you with a list of all the IAM users and roles along with their assignments.
- Identify the misconfigured user or role: Review the list of IAM users and roles to identify the one with privilege escalation. You can look for roles like “Owner” or “Contributor” or any custom roles that grant excessive permissions.
-
Remove the privilege escalation assignment: Once you have identified the misconfigured user or role, run the following command to remove the assignment:
Replace
<assignee-id>with the ID or name of the user or role you want to remove the assignment from. You can find the ID or name in the output of the previous command. -
Verify the remediation: Run the list command again to ensure that the misconfigured user or role has been successfully removed:
Confirm that the user or role is no longer listed with the privilege escalation assignment.
Using Python
Using Python
To remediate the IAM user or role privilege escalation misconfiguration in Azure using Python, follow these steps:Replace
-
Install the necessary libraries:
- Install the Azure Identity library:
pip install azure-identity - Install the Azure Management IAM library:
pip install azure-mgmt-authorization
- Install the Azure Identity library:
- Import the required libraries in your Python script:
- Authenticate with Azure using the DefaultAzureCredential:
<subscription_id> with the ID of your Azure subscription.-
Identify the IAM user or role with privilege escalation:
- Get a list of all IAM roles:
Replace<scope>with the appropriate scope (e.g., ‘/subscriptions/<subscription_id>’).- Search for the specific role with privilege escalation. The role’s
permissionsproperty should include the necessary privileges.
-
Revoke the privilege escalation by removing the user or role from the role assignment:
- Get a list of all role assignments:
-
Identify the role assignment associated with the user or role with privilege escalation. You can filter the
role_assignmentslist based on the user or role’s principal ID or display name. - Revoke the role assignment by its ID:
Replace<scope>with the appropriate scope (e.g.,/subscriptions/<subscription_id>) and<role_assignment_id>with the ID of the role assignment to be deleted. - Save and run the Python script.