Risk Level: High
Cloud Entity: Azure role-based access control
CloudGuard Rule ID: D9.AZU.IAM.37
Covered by Spectral: No
Category: Security, Identity, & Compliance

GSL LOGIC

RoleAssignment should not have getResources('RoleDefinition', properties.roleDefinitionId, 'id' ) getValues('properties.roleName') contain [ 'Owner' ]

REMEDIATION

From Portal

Go to 'Access control (IAM)' in the relevant resource
Choose the 'Role assignments' tab in the upper menu
Audit the relevant role assignment according to the principle of least privilege

From TF
Audit the relevant role definition, according to the 'azurerm_role_assignment' resource:

resource "azurerm_role_assignment" "role_assignment_example" {
	..
	role_definition_id = azurerm_role_definition.example.role_definition_resource_id
	..
}

From Command Line
To list current subscription and below role assignments by query, use:

az role assignment list --all --query QUERY

References

Azure role-based access control

Azure role-based access control (Azure RBAC) is the authorization system you use to manage access to Azure resources. To grant access, you assign roles to users, groups, service principals, or managed identities at a particular scope.

Compliance Frameworks

AZU PCI-DSS 4.0
Azure CloudGuard Best Practices
Azure NIST 800-53 Rev 5
CloudGuard Azure All Rules Ruleset