No custom roles should grant Owner-equivalent permissions

High Azure General subscriptionrolesecurity-custom-roles-grant-owner

Applies to

Microsoft.Authorization/subscriptionRoleSecurity

What CGPulse checks

A resource passes this rule when customRoles.hasCustomOwnerRole must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Remove wildcard (*) permissions from custom roles to enforce least privilege. In Azure Portal: Subscriptions > Access control (IAM) > Roles > edit custom roles. See: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

Careful: Modifying custom roles may break existing access for users and applications

CLI

az role definition list --custom-role-only -o table

Terraform

# Review custom role definitions - remove wildcard (*) actions
# resource "azurerm_role_definition" "{name}" {
#   name  = "custom-role"
#   scope = data.azurerm_subscription.current.id
#   permissions {
#     actions     = ["Microsoft.Compute/*"]  # avoid "*"
#     not_actions = []
#   }
# }

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan