Azure Roles Assumable By Compute Services Remediation

Triage and Remediation

Remediation

Remediation

Using Console

None

Using CLI

To remediate the misconfiguration of roles assumable by compute services in Azure using the Azure CLI, follow these step-by-step instructions:

Install and set up the Azure CLI on your local machine if you haven't already. You can find the installation guide at https://docs.microsoft.com/en-us/cli/azure/install-azure-cli.
Open a command prompt or terminal and log in to your Azure account using the following command:
```
az login
```
If you have multiple subscriptions, set the desired subscription where the remediation needs to be applied using the following command:
```
az account set --subscription <subscription_id>
```

List all the existing role assignments for the compute services using the following command:

az role assignment list --all --query "[?contains(roleDefinitionName, 'Virtual Machine Contributor') && contains(principalType, 'ServicePrincipal')]"

Identify the role assignments that need to be remediated. Make a note of the principalId and scope values for each role assignment.
Remove the role assignments using the following command for each role assignment:
```
az role assignment delete --assignee <principalId> --scope <scope>
```
Replace <principalId> with the principalId value obtained in step 5 and <scope> with the scope value obtained in step 5.
Verify that the role assignments have been successfully removed by re-running the command in step 4.

By following these steps, you will be able to remediate the misconfiguration of roles assumable by compute services in Azure using the Azure CLI.

Using Python

To remediate the misconfiguration of roles assumable by compute services in Azure using Python, you can follow these steps:

Install the required Python packages:

pip install azure-identity
pip install azure-mgmt-resource

Import the necessary modules in your Python script:

from azure.identity import DefaultAzureCredential
from azure.mgmt.resource import ResourceManagementClient

Authenticate with Azure using the default credentials:
```
credential = DefaultAzureCredential()
```

Create an instance of the ResourceManagementClient:

subscription_id = "<your-subscription-id>"
resource_client = ResourceManagementClient(credential, subscription_id)

Get the list of compute resources in your Azure subscription:

compute_resources = resource_client.resources.list(filter="resourceType eq 'Microsoft.Compute/virtualMachines'")

Iterate over the compute resources and check their role assignments:

for compute_resource in compute_resources:
    resource_id = compute_resource.id
    role_assignments = resource_client.role_assignments.list_for_resource(resource_id)
    for role_assignment in role_assignments:
        if role_assignment.principal_type == "ServicePrincipal":
            print(f"Compute resource {resource_id} has a role assignment with principal type ServicePrincipal: {role_assignment.role_definition_name}")

Review the output to identify any compute resources with role assignments that need remediation.
To remediate the misconfiguration, you can remove the role assignments for compute resources that are not intended to have them. Use the delete method from the RoleAssignmentsOperations class:
```
resource_client.role_assignments.delete(role_assignment_name)
```

Note: Make sure to replace <your-subscription-id> with your actual Azure subscription ID in step 4.

By following these steps, you can identify and remediate the misconfiguration of roles assumable by compute services in Azure using Python.

Using Terraform

# Example: restrict a managed identity's role assignment for a VM
# Substitute:
# - AZURE_SUBSCRIPTION_ID with your subscription ID
# - RESOURCE_GROUP_NAME with the resource group that actually contains the resources the workload touches
# - ROLE_DEFINITION_ID_OR_NAME with a least‑privilege built‑in or custom role for the workload
# - VM_NAME with your VM's name

data "azurerm_subscription" "current" {}

data "azurerm_resource_group" "workload_rg" {
  name = "RESOURCE_GROUP_NAME" # scope the role to only this RG instead of the whole subscription
}

data "azurerm_linux_virtual_machine" "vm" {
  name                = "VM_NAME"
  resource_group_name = data.azurerm_resource_group.workload_rg.name
}

data "azurerm_role_definition" "workload_role" {
  # Use a least-privilege role; for custom roles, use name or ID
  name  = "ROLE_DEFINITION_ID_OR_NAME"
  scope = data.azurerm_resource_group.workload_rg.id
}

resource "azurerm_role_assignment" "vm_identity_least_privilege" {
  scope              = data.azurerm_resource_group.workload_rg.id
  role_definition_id = data.azurerm_role_definition.workload_role.role_definition_id
  principal_id       = data.azurerm_linux_virtual_machine.vm.identity[0].principal_id
}

Changing scope or role_definition_id on an existing azurerm_role_assignment forces replacement of that role assignment, which immediately changes the permissions granted to the VM’s managed identity.

To remediate: remove any broad or unnecessary azurerm_role_assignment resources that target the VM’s identity (for example, those scoped at the subscription or management group) and replace them with a single azurerm_role_assignment like the one above, using the narrowest possible scope and least‑privilege role.

Verification with terraform plan should show the undesired wide-scope role assignments being destroyed and a single azurerm_role_assignment.vm_identity_least_privilege being created (or updated with a reduced scope/role).

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation