Posture check: Azure subscriptions with custom roles are overly permissive
Query: ```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-definition' AND json.rule = properties.type equals "CustomRole" and properties.assignableScopes[*] contains "/" and properties.permissions[*].actions[*] starts with "*"```