> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure roles assumable by container services remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of roles assumable by container services in Azure using the Azure console, follow these steps: 1. Sign in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) using your Azure account credentials. 2. In the Azure portal, navigate to the Azure Container Instances service by searching for "Container Instances" in the search bar at the top. 3. Click on the "Container Instances" service from the search results to open the Azure Container Instances page. 4. On the left-hand side menu, click on "Access control (IAM)" to manage the access control settings for the Azure Container Instances service. 5. In the "Access control (IAM)" page, you will see a list of roles assigned to different users and groups. Look for any roles that are misconfigured or should not be assumable by container services. 6. To remediate the misconfiguration, click on the role that you want to modify or remove from the container service. 7. In the role details page, you will see a list of assigned users or groups. To remove a user or group from the role, select the checkbox next to their name and click on the "Remove" button at the top. 8. If you want to modify the role permissions, click on the "Add role assignment" button at the top of the page. 9. In the "Add role assignment" panel, select the appropriate role from the "Role" dropdown menu. You can choose from built-in roles like "Contributor" or "Reader", or create a custom role with specific permissions. 10. Specify the user or group that should be assigned the role by selecting them from the "Assign access to" dropdown menu. 11. Click on the "Save" button to apply the changes and remediate the misconfiguration. 12. Repeat steps 6 to 11 for any other misconfigured roles that need to be remediated. By following these steps, you can remediate the misconfiguration of roles assumable by container services in Azure using the Azure console. # To remediate the misconfiguration of roles assumable by container services in Azure, you can follow these step-by-step instructions using Azure CLI: 1. Install Azure CLI: If you haven't already, install the Azure CLI on your local machine by following the instructions provided by Microsoft. 2. Login to Azure: Open your command prompt or terminal and login to your Azure account using the command: ``` az login ``` 3. Select the Azure subscription: If you have multiple subscriptions, select the appropriate subscription using the command: ``` az account set --subscription ``` 4. List container services: Run the following command to list all the container services in your Azure subscription: ``` az aks list ``` 5. Get the AKS cluster resource group: Identify the resource group associated with the AKS cluster you want to remediate. Run the following command, replacing `` with the actual name: ``` az aks show --name --resource-group --query nodeResourceGroup -o tsv ``` 6. List role assignments: Now, list the current role assignments for the AKS cluster by running the following command, replacing `` with the actual name: ``` az role assignment list --resource-group ``` 7. Remove unwanted role assignments: Identify the role assignments that are not required or should not be assumable by container services. Use the following command to remove each unwanted role assignment, replacing `` with the actual ID: ``` az role assignment delete --ids ``` 8. Verify the remediation: Run the command from Step 6 again to ensure that the unwanted role assignments have been successfully removed. By following these steps, you will be able to remediate the misconfiguration of roles assumable by container services in Azure using Azure CLI. To remediate the misconfiguration of roles assumable by container services in Azure IAM, you can follow these steps using Python: 1. Install the required Python libraries: ```python theme={null} pip install azure-identity pip install azure-mgmt-containerinstance ``` 2. Import the necessary modules: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.containerinstance import ContainerInstanceManagementClient from azure.mgmt.authorization import AuthorizationManagementClient from azure.mgmt.authorization.models import RoleAssignmentCreateParameters ``` 3. Authenticate to Azure using the default credentials: ```python theme={null} credential = DefaultAzureCredential() ``` 4. Create an instance of the ContainerInstanceManagementClient: ```python theme={null} container_client = ContainerInstanceManagementClient(credential, subscription_id) ``` 5. Get the list of container groups: ```python theme={null} container_groups = container_client.container_groups.list(resource_group_name) ``` 6. Iterate through the container groups and check their assigned roles: ```python theme={null} for container_group in container_groups: container_group_name = container_group.name roles = container_client.container_groups.list_role_assignments( resource_group_name, container_group_name ) for role in roles: if role.properties.principal_type == 'ServicePrincipal': # Remove the role assignment container_client.container_groups.delete_role_assignment( resource_group_name, container_group_name, role.name ) ``` 7. Create an instance of the AuthorizationManagementClient: ```python theme={null} auth_client = AuthorizationManagementClient(credential, subscription_id) ``` 8. Get the list of role definitions: ```python theme={null} role_definitions = auth_client.role_definitions.list(scope) ``` 9. Iterate through the role definitions and assign the necessary roles: ```python theme={null} for role_definition in role_definitions: if role_definition.role_name == 'Contributor': # Assign the role to the container group role_assignment = RoleAssignmentCreateParameters( role_definition_id=role_definition.id, principal_id=service_principal_id ) auth_client.role_assignments.create(scope, role_assignment) ``` Make sure to replace the following variables with your own values: * `subscription_id`: Azure subscription ID * `resource_group_name`: Resource group name where the container groups are located * `scope`: The scope of the role assignment (e.g., `/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}`) * `service_principal_id`: The ID of the service principal associated with the container service By following these steps, you will be able to remediate the misconfiguration of roles assumable by container services in Azure IAM using Python. ```hcl theme={null} # Give the workload its own managed identity rather than using the shared # cluster / container group / container app identity. resource "azurerm_user_assigned_identity" "WORKLOAD_IDENTITY" { name = "WORKLOAD_IDENTITY_NAME" # replace with the workload-specific identity name resource_group_name = "RESOURCE_GROUP_NAME" # replace with the resource group name location = "AZURE_LOCATION" # replace with the Azure region } # Scope the role assignment to only the resources this workload owns. # Replace this example with the actual resource the workload should access. resource "azurerm_storage_account" "WORKLOAD_RESOURCE" { name = "STORAGE_ACCOUNT_NAME" # replace with a unique storage account name resource_group_name = "RESOURCE_GROUP_NAME" # replace with the resource group name location = "AZURE_LOCATION" # replace with the Azure region account_tier = "Standard" account_replication_type = "LRS" } # Narrow, workload-specific role assignment: identity is the workload-specific # managed identity, scope is just the workload-owned resource. resource "azurerm_role_assignment" "WORKLOAD_ROLE" { scope = azurerm_storage_account.WORKLOAD_RESOURCE.id role_definition_name = "Storage Blob Data Contributor" # replace with the least-privilege role needed principal_id = azurerm_user_assigned_identity.WORKLOAD_IDENTITY.principal_id } # Remove or update any existing broad role assignments that currently grant # roles to the container platform identity (AKS / ACI / Container Apps managed # identity) over subscription- or resource-group-wide scopes. # Example of an overly broad assignment to delete or refactor: # resource "azurerm_role_assignment" "CLUSTER_WIDE_ROLE" { # scope = "/subscriptions/SUBSCRIPTION_ID" # too broad # role_definition_name = "Contributor" # too powerful # principal_id = "CLUSTER_MANAGED_IDENTITY_OBJECT_ID" # shared by many workloads # } ``` If you are currently managing the broad assignment (`azure-securityandidentity-iam-role`) in Terraform, you must either delete that `azurerm_role_assignment` resource or change its `principal_id` and `scope` to match the workload-specific identity and resource as in `azurerm_role_assignment.WORKLOAD_ROLE`; otherwise the misconfiguration will persist. This change does not force replacement of the underlying AKS/ACI/container app resources, but it will revoke the old permissions as soon as the broad `azurerm_role_assignment` is removed, so ensure the new, scoped assignment is applied first to avoid outages. Verification: `terraform plan` should show the existing broad `azurerm_role_assignment` scheduled for destruction (or its `principal_id`/`scope` arguments changing), and a new, narrower `azurerm_role_assignment` created that targets the workload-specific managed identity at the least-privilege scope.