Roles Assumable By Database Services
More Info:
Roles which can be assumed by Database ServicesRisk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of roles assumable by database services in Azure IAM, follow these step-by-step instructions using the Azure console:
- Sign in to the Azure portal (https://portal.azure.com) using your Azure account credentials.
- In the Azure portal, navigate to the Azure Active Directory (AAD) service by selecting “Azure Active Directory” from the left-hand menu.
- In the Azure AD overview page, click on “Enterprise applications” in the left-hand menu.
- In the Enterprise applications page, search for “Azure Database for PostgreSQL” or “Azure Database for MySQL” based on the database service you are using.
- Click on the appropriate database service application.
- In the application’s overview page, click on “Properties” in the left-hand menu.
- Under the “Managed application” section, click on the “Users and groups” option.
- In the “Users and groups” page, review the list of users and groups that have access to assume the role of the database service.
- Identify any users or groups that should not have this role assumption privilege and should be remediated.
- To remove a user or group’s role assumption privilege, click on the respective user or group.
- In the user or group’s overview page, click on the “Roles and administrators” option in the left-hand menu.
- In the “Roles and administrators” page, review the list of roles assigned to the user or group.
- Identify the role that grants the privilege to assume the role of the database service and should be removed.
- To remove the role, click on the role and then click on the “Remove assignment” button.
- Confirm the removal of the role assignment when prompted.
- Repeat steps 10-15 for any other users or groups that need to have their role assumption privilege remediated.
- Once all necessary role assumption privileges have been removed, you have successfully remediated the issue of roles assumable by database services in Azure IAM.
Using CLI
Using CLI
To remediate the misconfiguration “Roles Assumable By Database Services” in Azure using Azure CLI, follow these step-by-step instructions:
- Install Azure CLI: If you haven’t already, install Azure CLI on your local machine by following the instructions provided by Microsoft.
-
Log in to Azure: Open the command prompt or terminal and log in to your Azure account using the following command:
-
Set the Azure subscription: If you have multiple Azure subscriptions, set the appropriate subscription using the following command:
-
List existing roles: Run the following command to list all the existing roles in your Azure subscription:
- Identify the roles assigned to database services: Review the list of roles and identify the roles assigned to database services. These roles typically have names like “Contributor”, “Owner”, or “Reader”.
-
Create a custom role: If the existing roles assigned to database services do not meet your requirements, you can create a custom role with limited permissions. Create a JSON file (e.g.,
custom-role.json) with the necessary permissions for database services. Here’s an example of a custom role JSON file that allows read access to databases and denies write access:Modify theAssignableScopesfield with the appropriate subscription ID. -
Create the custom role: Run the following command to create the custom role:
-
Assign the custom role to database services: Now, assign the newly created custom role to the appropriate database services. Replace
<custom_role_name>with the name you provided in the custom role JSON file and<database_service_name>with the name of the database service you want to assign the role to. Run the following command:Repeat this step for each database service that needs the custom role assigned. -
Verify the role assignment: To verify that the custom role has been successfully assigned to the database services, run the following command:
This command will list all the role assignments for the specified database service.
Using Python
Using Python
To remediate the misconfiguration “Roles Assumable By Database Services” in Azure using Python, follow these steps:
-
Install the necessary dependencies:
-
Import the required modules:
-
Authenticate with Azure using the DefaultAzureCredential:
-
Get the list of all the role assignments for the database services:
-
Iterate over the role assignments and remove any inappropriate assignments:
-
Verify the remediation by rechecking the role assignments:
<subscription_id> with your Azure subscription ID in the code above. This code will remove any role assignments for the database services in Azure that have the ‘Contributor’ or ‘Owner’ role and are assigned to Service Principals or Users.