Custom roles should be minimized

Medium Azure General subscriptionrolesecurity-custom-roles-minimized

Applies to

Microsoft.Authorization/subscriptionRoleSecurity

What CGPulse checks

A resource passes this rule when customRoles.count must be less than 6. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Consolidate custom roles or use built-in roles to reduce permission creep. In Azure Portal: Subscriptions > Access control (IAM) > Roles > review and consolidate. See: https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

Careful: Review each custom role — prefer built-in roles where possible

CLI

az role definition list --custom-role-only -o table

Terraform

# Review and consolidate custom roles; prefer built-in roles
# resource "azurerm_role_definition" "{name}" {
#   name  = "custom-role"
#   scope = data.azurerm_subscription.current.id
#   permissions {
#     actions     = ["Microsoft.Compute/virtualMachines/read"]
#     not_actions = []
#   }
# }

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan