Project: KICS (Provisioning / Security & Compliance)
File: 8fa9ceea-881f-4ef0-b0b8-728f589699a7.md

title: Role Definitions Allow Custom Subscription Role Creation hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 8fa9ceea-881f-4ef0-b0b8-728f589699a7 Query name: Role Definitions Allow Custom Subscription Role Creation Platform: AzureResourceManager Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Role Definitions should not allow custom subscription role creation (actions set to '*' or 'Microsoft.Authorization/roleDefinitions/write')<br> ```json title="Positive test num. 1 - json file" hl_lines="18" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "roleDef", "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-01-01-preview", "properties": { "roleName": "my-custom-role", "description": "This is a custom role", "permissions": [ { "actions": [ "*" ] } ], "assignableScopes": [ "[subscription().id]" ] } } ], "outputs": {} } ``` ```json title="Positive test num. 2 - json file" hl_lines="18" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "roleDef", "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-01-01-preview", "properties": { "roleName": "my-custom-role", "description": "This is a custom role", "permissions": [ { "actions": [ "Microsoft.Authorization/roleDefinitions/write" ] } ], "assignableScopes": [ "[subscription().id]" ] } } ], "outputs": {} } ``` ```json title="Positive test num. 3 - json file" hl_lines="20" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "roleDef", "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-01-01-preview", "properties": { "roleName": "my-custom-role", "description": "This is a custom role", "permissions": [ { "actions": [ "*" ] } ], "assignableScopes": [ "[subscription().id]" ] } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="20" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "roleDef", "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-01-01-preview", "properties": { "roleName": "my-custom-role", "description": "This is a custom role", "permissions": [ { "actions": [ "Microsoft.Authorization/roleDefinitions/write" ] } ], "assignableScopes": [ "[subscription().id]" ] } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "roleDef", "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-01-01-preview", "properties": { "roleName": "my-custom-role", "description": "This is a custom role", "permissions": [ { "actions": [ "Microsoft.Authorization/roleDefinitions/read" ] } ], "assignableScopes": [ "[subscription().id]" ] } } ], "outputs": {} } ``` ```json title="Negative test num. 2 - json file" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "roleDef", "type": "Microsoft.Authorization/roleDefinitions", "apiVersion": "2018-01-01-preview", "properties": { "roleName": "my-custom-role", "description": "This is a custom role", "permissions": [ { "actions": [ "Microsoft.Authorization/roleDefinitions/read" ] } ], "assignableScopes": [ "[subscription().id]" ] } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ```