> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure roles assumable by compute services remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        None

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of roles assumable by compute services in Azure using the Azure CLI, follow these step-by-step instructions:

        1. Install and set up the Azure CLI on your local machine if you haven't already. You can find the installation guide at [https://docs.microsoft.com/en-us/cli/azure/install-azure-cli](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli).

        2. Open a command prompt or terminal and log in to your Azure account using the following command:
           ```
           az login
           ```

        3. If you have multiple subscriptions, set the desired subscription where the remediation needs to be applied using the following command:
           ```
           az account set --subscription <subscription_id>
           ```

        4. List all the existing role assignments for the compute services using the following command:
           ```
           az role assignment list --all --query "[?contains(roleDefinitionName, 'Virtual Machine Contributor') && contains(principalType, 'ServicePrincipal')]"
           ```

        5. Identify the role assignments that need to be remediated. Make a note of the `principalId` and `scope` values for each role assignment.

        6. Remove the role assignments using the following command for each role assignment:

           ```
           az role assignment delete --assignee <principalId> --scope <scope>
           ```

           Replace `<principalId>` with the `principalId` value obtained in step 5 and `<scope>` with the `scope` value obtained in step 5.

        7. Verify that the role assignments have been successfully removed by re-running the command in step 4.

        By following these steps, you will be able to remediate the misconfiguration of roles assumable by compute services in Azure using the Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of roles assumable by compute services in Azure using Python, you can follow these steps:

        1. Install the required Python packages:
           ```python theme={null}
           pip install azure-identity
           pip install azure-mgmt-resource
           ```

        2. Import the necessary modules in your Python script:
           ```python theme={null}
           from azure.identity import DefaultAzureCredential
           from azure.mgmt.resource import ResourceManagementClient
           ```

        3. Authenticate with Azure using the default credentials:
           ```python theme={null}
           credential = DefaultAzureCredential()
           ```

        4. Create an instance of the ResourceManagementClient:
           ```python theme={null}
           subscription_id = "<your-subscription-id>"
           resource_client = ResourceManagementClient(credential, subscription_id)
           ```

        5. Get the list of compute resources in your Azure subscription:
           ```python theme={null}
           compute_resources = resource_client.resources.list(filter="resourceType eq 'Microsoft.Compute/virtualMachines'")
           ```

        6. Iterate over the compute resources and check their role assignments:
           ```python theme={null}
           for compute_resource in compute_resources:
               resource_id = compute_resource.id
               role_assignments = resource_client.role_assignments.list_for_resource(resource_id)
               for role_assignment in role_assignments:
                   if role_assignment.principal_type == "ServicePrincipal":
                       print(f"Compute resource {resource_id} has a role assignment with principal type ServicePrincipal: {role_assignment.role_definition_name}")
           ```

        7. Review the output to identify any compute resources with role assignments that need remediation.

        8. To remediate the misconfiguration, you can remove the role assignments for compute resources that are not intended to have them. Use the `delete` method from the `RoleAssignmentsOperations` class:
           ```python theme={null}
           resource_client.role_assignments.delete(role_assignment_name)
           ```

        Note: Make sure to replace `<your-subscription-id>` with your actual Azure subscription ID in step 4.

        By following these steps, you can identify and remediate the misconfiguration of roles assumable by compute services in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Example: restrict a managed identity's role assignment for a VM
        # Substitute:
        # - AZURE_SUBSCRIPTION_ID with your subscription ID
        # - RESOURCE_GROUP_NAME with the resource group that actually contains the resources the workload touches
        # - ROLE_DEFINITION_ID_OR_NAME with a least‑privilege built‑in or custom role for the workload
        # - VM_NAME with your VM's name

        data "azurerm_subscription" "current" {}

        data "azurerm_resource_group" "workload_rg" {
          name = "RESOURCE_GROUP_NAME" # scope the role to only this RG instead of the whole subscription
        }

        data "azurerm_linux_virtual_machine" "vm" {
          name                = "VM_NAME"
          resource_group_name = data.azurerm_resource_group.workload_rg.name
        }

        data "azurerm_role_definition" "workload_role" {
          # Use a least-privilege role; for custom roles, use name or ID
          name  = "ROLE_DEFINITION_ID_OR_NAME"
          scope = data.azurerm_resource_group.workload_rg.id
        }

        resource "azurerm_role_assignment" "vm_identity_least_privilege" {
          scope              = data.azurerm_resource_group.workload_rg.id
          role_definition_id = data.azurerm_role_definition.workload_role.role_definition_id
          principal_id       = data.azurerm_linux_virtual_machine.vm.identity[0].principal_id
        }
        ```

        Changing `scope` or `role_definition_id` on an existing `azurerm_role_assignment` forces replacement of that role assignment, which immediately changes the permissions granted to the VM’s managed identity.

        To remediate: remove any broad or unnecessary `azurerm_role_assignment` resources that target the VM’s identity (for example, those scoped at the subscription or management group) and replace them with a single `azurerm_role_assignment` like the one above, using the narrowest possible scope and least‑privilege role.

        Verification with `terraform plan` should show the undesired wide-scope role assignments being destroyed and a single `azurerm_role_assignment.vm_identity_least_privilege` being created (or updated with a reduced scope/role).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>