> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Principals With Broad Access To Data Services

### More Info:

Identifies principals whose role assignments give them access to data services - storage accounts, databases, key vaults and messaging. Data access spread thinly across many identities is hard to reason about and is what makes a single compromised credential expensive. Review each assignment and cut it back to the specific data stores the identity needs.

### Risk Level

High

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the issue of roles having suspicious access in Azure IAM (Identity and Access Management) using the Azure console, follow these steps:

        1. Sign in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)) using your Azure account credentials.

        2. In the Azure portal, navigate to the Azure Active Directory (AAD) service. You can find it by searching for "Azure Active Directory" in the search bar at the top.

        3. In the Azure Active Directory dashboard, select "Roles and administrators" from the left-hand menu.

        4. On the Roles and administrators page, you will see a list of built-in roles and custom roles defined in your Azure AD tenant. Review the roles and identify any suspicious roles that have unauthorized or excessive access permissions.

        5. Click on the suspicious role to view its details and permissions.

        6. In the role details page, review the assigned users, groups, or applications to identify any unauthorized assignments. Remove any inappropriate assignments by selecting the assignment and clicking on the "Remove" button.

        7. If the suspicious role is a custom role, you may need to modify its permissions to limit access. Click on the "Permissions" tab and review the permissions assigned to the role. Remove any unnecessary or excessive permissions by selecting them and clicking on the "Remove" button.

        8. Once you have removed unauthorized assignments and modified permissions if required, click on the "Save" button to apply the changes.

        9. Repeat steps 5 to 8 for all suspicious roles identified in your Azure AD tenant.

        10. After remediation, it is recommended to monitor the roles and access permissions regularly to ensure ongoing security. Consider implementing Azure AD Privileged Identity Management (PIM) to enforce just-in-time access and periodic access reviews for critical roles.

        By following these steps, you can remediate the issue of roles having suspicious access in Azure IAM using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the issue of roles having suspicious access in Azure using Azure CLI, follow these steps:

        1. Identify the suspicious roles:
           * Run the following command to list all the roles in your Azure subscription:
             ```
             az role definition list --query "[].{Name:name, Id:id, IsCustom:isCustom}" --output table
             ```
           * Review the output and identify any roles that seem suspicious or have unnecessary permissions.

        2. Revoke suspicious roles:
           * Run the following command to revoke a role from a specific user or service principal:
             ```
             az role assignment delete --assignee <assignee-object-id> --role <role-name>
             ```
             Replace `<assignee-object-id>` with the object ID of the user or service principal you want to revoke the role from, and `<role-name>` with the name of the suspicious role.
           * Repeat this command for each suspicious role that needs to be revoked.

        3. Review and modify built-in roles:
           * Run the following command to list all built-in roles in your Azure subscription:
             ```
             az role definition list --name "Owner" --output json
             ```
           * Review the output and identify any built-in roles that have excessive permissions.
           * To modify a built-in role, create a custom role with the necessary permissions and assign it instead. You can use the `az role definition create` command to create a custom role and the `az role assignment create` command to assign it.

        4. Implement Just-in-Time (JIT) access:
           * JIT access allows you to grant temporary, time-bound access to specific roles when needed. This reduces the risk of unauthorized access.
           * Follow the Azure documentation to configure and enable JIT access for your Azure resources: [Azure JIT access documentation](https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time)

        5. Regularly review and update role assignments:
           * It's important to periodically review and update role assignments in your Azure subscription to ensure they align with your organization's security requirements.
           * Use the Azure portal, Azure CLI, or Azure PowerShell to review and manage role assignments regularly.

        By following these steps, you can remediate the issue of roles having suspicious access in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the issue of roles having suspicious access in Azure using Python, follow these steps:

        1. Install the required dependencies:
           ```python theme={null}
           pip install azure-mgmt-resource azure-identity
           ```

        2. Import the necessary modules:
           ```python theme={null}
           from azure.identity import DefaultAzureCredential
           from azure.mgmt.resource import ResourceManagementClient
           from azure.mgmt.authorization import AuthorizationManagementClient
           ```

        3. Authenticate to Azure using default credentials:
           ```python theme={null}
           credential = DefaultAzureCredential()
           subscription_id = "<your-subscription-id>"
           resource_client = ResourceManagementClient(credential, subscription_id)
           authorization_client = AuthorizationManagementClient(credential, subscription_id)
           ```

        4. Retrieve the list of roles in the subscription:
           ```python theme={null}
           roles = authorization_client.role_definitions.list()
           ```

        5. Iterate through each role to identify suspicious access:
           ```python theme={null}
           for role in roles:
               role_name = role.role_name
               permissions = role.permissions
               # Check for suspicious permissions or access levels
               # Add your logic here to identify suspicious access
           ```

        6. Once suspicious roles are identified, you can take appropriate actions, such as removing or modifying the role. To remove a role, use the following code:

           ```python theme={null}
           role_id = "<role-id-to-remove>"
           authorization_client.role_definitions.delete(scope, role_id)
           ```

           Note: Replace `<role-id-to-remove>` with the actual ID of the role you want to remove.

        7. If you want to modify the role, you can update its permissions using the following code:

           ```python theme={null}
           role_id = "<role-id-to-modify>"
           updated_permissions = [
               {
                   "actions": ["<action-1>", "<action-2>"],
                   "notActions": [],
                   "dataActions": [],
                   "notDataActions": []
               }
           ]
           authorization_client.role_definitions.update(scope, role_id, updated_permissions)
           ```

           Note: Replace `<role-id-to-modify>` with the actual ID of the role you want to modify, and `<action-1>`, `<action-2>`, etc., with the desired actions.

        8. Finally, run the Python script to remediate the suspicious access issue.

        Please note that this is a general guide, and you may need to adapt it to your specific requirements and the suspicious access patterns you are looking for.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # This specific finding cannot be remediated on the "IAM user" resource itself.
        # In Azure, broad data access is granted via role assignments (RBAC),
        # not by properties on the user object. Terraform does not expose a
        # permission-related argument on an "iam user" resource that could
        # narrow data access.

        # To actually remediate, you must change the *role assignments* that
        # reference this principal (user / service principal / managed identity).
        # That is a different surface (azurerm_role_assignment), not the user.

        # Example (for illustration only — this is NOT on the user resource):
        # Replace a broad subscription‑level role with a narrowly scoped one.

        resource "azurerm_role_assignment" "data_access_narrow" {
          scope                = azurerm_storage_account.DATA_STORE.id          # replace with the specific data resource the principal truly needs
          role_definition_name = "Storage Blob Data Contributor"                # replace with the least‑privilege role actually required
          principal_id         = AZURE_AD_OBJECT_ID_OF_PRINCIPAL                # substitute the object ID of the IAM user / principal
        }

        # Remove or update existing broad assignment(s), for example:
        # - Subscription scope
        # - Resource group scope
        # - Roles like "Contributor", "Owner", or broad data roles

        # Example removal (Terraform-managed existing assignment):
        # resource "azurerm_role_assignment" "broad_data_access" {
        #   # This would be removed from configuration to drop the broad access
        # }

        # Verification with Terraform:
        # - `terraform plan` should show:
        #   - Destruction of any broad azurerm_role_assignment resources you removed.
        #   - Creation or update of narrower azurerm_role_assignment resources,
        #     with reduced scope and/or more restrictive roles.
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>