> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Permissions That Allow Privilege Escalation ### More Info: Identifies principals whose permissions can be chained to grant themselves more access than they hold today, typically by creating or editing role assignments or by taking control of an identity that already has them. Their effective access is therefore higher than their current assignments suggest. Keep role-granting permissions off everyday identities and behind a reviewed, time-bound elevation path. ### Risk Level Medium ### Address Security ### Compliance Standards * CIS AZURE * HIPAA * HITRUST CSF * ISO 27001 * NIST CSF * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 ### Triage and Remediation ### Remediation To remediate the misconfiguration of an IAM user or role with privilege escalation in Azure, you can follow these step-by-step instructions using the Azure console: 1. Sign in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) using your administrator account. 2. Navigate to the "Azure Active Directory" service from the left-hand menu. 3. In the Azure Active Directory overview page, select "Users" or "Roles" based on whether the misconfiguration is related to a user or a role. 4. If the misconfiguration is related to a user, search for the affected user in the "Users" section and select it. If it is related to a role, go to the "Roles and administrators" section and select the affected role. 5. In the user or role details page, review the assigned permissions and privileges. 6. To remediate the privilege escalation, you have two options: a. Remove the user or role: If the user or role is not required, you can remove it by selecting the "Delete" or "Remove" option. Confirm the action when prompted. b. Modify the assigned permissions: If the user or role is required but has excessive permissions, you can modify the assigned permissions to reduce the privilege level. To do this, select the "Permissions" or "Assignments" tab in the user or role details page. 7. In the permissions or assignments tab, review the existing permissions or assignments and identify the excessive or unnecessary ones. 8. To modify the permissions or assignments, select the specific permission or assignment and choose the "Remove" or "Revoke" option. Confirm the action when prompted. 9. Repeat step 8 for all the excessive or unnecessary permissions or assignments. 10. Once you have removed or modified the necessary permissions or assignments, review the remaining permissions or assignments to ensure they align with the principle of least privilege. 11. Save the changes and exit the user or role details page. By following these steps, you can remediate the misconfiguration of an IAM user or role with privilege escalation in Azure using the Azure console. # To remediate the IAM user or role with privilege escalation misconfiguration in Azure, you can follow these step-by-step instructions using Azure CLI: 1. Install Azure CLI: If you haven't already, install Azure CLI on your local machine by following the instructions provided by Microsoft for your operating system. 2. Authenticate with Azure: Open a terminal or command prompt and run the following command to sign in to Azure using Azure CLI: ``` az login ``` 3. List IAM users or roles: Run the following command to list all the IAM users and roles in your Azure subscription: ``` az role assignment list --all ``` This command will provide you with a list of all the IAM users and roles along with their assignments. 4. Identify the misconfigured user or role: Review the list of IAM users and roles to identify the one with privilege escalation. You can look for roles like "Owner" or "Contributor" or any custom roles that grant excessive permissions. 5. Remove the privilege escalation assignment: Once you have identified the misconfigured user or role, run the following command to remove the assignment: ``` az role assignment delete --assignee ``` Replace `` with the ID or name of the user or role you want to remove the assignment from. You can find the ID or name in the output of the previous command. 6. Verify the remediation: Run the list command again to ensure that the misconfigured user or role has been successfully removed: ``` az role assignment list --all ``` Confirm that the user or role is no longer listed with the privilege escalation assignment. By following these steps, you can remediate the IAM user or role with privilege escalation misconfiguration in Azure using Azure CLI. To remediate the IAM user or role privilege escalation misconfiguration in Azure using Python, follow these steps: 1. Install the necessary libraries: * Install the Azure Identity library: `pip install azure-identity` * Install the Azure Management IAM library: `pip install azure-mgmt-authorization` 2. Import the required libraries in your Python script: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.authorization import AuthorizationManagementClient ``` 3. Authenticate with Azure using the DefaultAzureCredential: ```python theme={null} credential = DefaultAzureCredential() authorization_client = AuthorizationManagementClient(credential, ) ``` Replace `` with the ID of your Azure subscription. 4. Identify the IAM user or role with privilege escalation: * Get a list of all IAM roles: ```python theme={null} roles = authorization_client.role_definitions.list(scope='') ``` Replace `` with the appropriate scope (e.g., '/subscriptions/``'). * Search for the specific role with privilege escalation. The role's `permissions` property should include the necessary privileges. 5. Revoke the privilege escalation by removing the user or role from the role assignment: * Get a list of all role assignments: ```python theme={null} role_assignments = authorization_client.role_assignments.list(scope='') ``` * Identify the role assignment associated with the user or role with privilege escalation. You can filter the `role_assignments` list based on the user or role's principal ID or display name. * Revoke the role assignment by its ID: ```python theme={null} authorization_client.role_assignments.delete(scope='', role_assignment_id='') ``` Replace `` with the appropriate scope (e.g., `/subscriptions/`) and `` with the ID of the role assignment to be deleted. 6. Save and run the Python script. By following these steps, you can remediate the IAM user or role privilege escalation misconfiguration in Azure using Python. ```hcl theme={null} # Azure AD user that currently has privilege-escalating permissions resource "azuread_user" "IAM_USER" { user_principal_name = "IAM_USER_UPN@example.com" # replace with the actual UPN display_name = "IAM_USER_DISPLAY_NAME" # replace with the actual display name mail_nickname = "IAM_USER_MAIL_NICKNAME" # replace with the actual mail nickname password = "TEMPORARY_PASSWORD" # replace with a secure temp password or use lifecycle/pwd profile as per your standards } # REMOVE OR AVOID CREATING ROLE ASSIGNMENTS THAT ALLOW PRIVILEGE ESCALATION # Example of a priv-esc role assignment to be removed: "User Access Administrator" # In Terraform, remediation is to delete this resource (or not create it at all). # If it already exists in state, remove it from code and run `terraform apply` to revoke the role. # This block shows the misconfiguration for context – DELETE it from your configuration: resource "azurerm_role_assignment" "IAM_USER_PRIV_ESC" { scope = "/subscriptions/SUBSCRIPTION_ID" # replace with the actual scope role_definition_name = "User Access Administrator" # example priv-esc role principal_id = azuread_user.IAM_USER.object_id } ``` Removing the `azurerm_role_assignment.IAM_USER_PRIV_ESC` resource from your Terraform code and applying will revoke the role-granting permission from the user without deleting the user itself. For verification, `terraform plan` should show the `azurerm_role_assignment.IAM_USER_PRIV_ESC` resource with a `-` (destroy) action and no remaining role assignments on this user that include role management or other privilege-escalation capabilities.