Evaluate CAF Custom IAM Roles #223
Comments
|
To evaluate these custom roles, we need an "example" user account (with an IDIR), to simulate a regular user in Azure, so that we can test/evaluate the custom permissions/roles that are being created (and linked with the security groups). Catherine is following up on this need with the Service Desk. UpdateMySC ticket submitted: REQ0631621 Update 2New testing account created.
Verified the account can log into Azure |
Out-of-the-Box PermissionsSubscription Owner"notActions": [
"Microsoft.Authorization/*/write",
"Microsoft.Network/vpnGateways/*",
"Microsoft.Network/expressRouteCircuits/*",
"Microsoft.Network/routeTables/write",
"Microsoft.Network/vpnSites/*"
],Application Owner"notActions": [
"Microsoft.Authorization/*/write",
"Microsoft.Network/publicIPAddresses/write",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.KeyVault/locations/deletedVaults/purge/action"
], |
Subscription-Owner Notes
UpdateThe And, because we're trying to assign the "Allow user to assign all roles except privileged administrator roles Owner, UAA, RBAC (Recommended)" condition, which allows the User to assign roles; but the custom role has the I cloned that Role, and removed that one What I don't know/see, is how to assign a Role without any conditions (since all conditions actually allow the User to assign Roles). So all conditions conflict with the custom Role notActions. So, both CAF custom roles have that same I kind of don't see how any of the custom CAF roles will work then, since they all will prevent the IAM conditions. |
|
Created the following GitHub Issue against the CAF: Bug Report: Custom CAF Roles Conflict with Entra ID Role Assignment Conditions. |
Project Set Resources (Out-of-the-Box)When we create a Project Set, we only create a VNet, peer that with the vWAN Hub, and config it's DNS to route through the firewall. What We Don't WantWe don't want end users to...
"actions": [
"Microsoft.Network/virtualNetworks/subnets/*"
],
"notActions": [
"Microsoft.Management/managementGroups/delete",
"Microsoft.Management/managementGroups/write",
"Microsoft.Management/managementGroups/subscriptions/delete",
"Microsoft.Management/managementGroups/subscriptions/write",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
"Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
"Microsoft.Network/virtualNetworks.properties.dhcpOptions.dnsServers/write",
"Microsoft.Network/expressRouteCircuits/*",
"Microsoft.Network/vpnSites/*",
"Microsoft.Network/vpnGateways/*",
"Microsoft.Network/virtualNetworkGateways/write",
"Microsoft.Network/connections/write", // Creates or updates an existing VirtualNetworkGatewayConnection
"Microsoft.Network/natGateways/*",
"Microsoft.Network/localnetworkgateways/write", // Creates or updates an existing LocalNetworkGateway
"Microsoft.Network/routeTables/write",
"Microsoft.Insights/DiagnosticSettings/setbypolicy/write",
"Microsoft.Insights/DiagnosticSettings/setbypolicy/delete",
"Microsoft.Network/networkWatchers/NetworkWatcher_canadacentral/delete",
"Microsoft.Network/networkWatchers/NetworkWatcher_canadacentral/write",
] |
Scenario: Rename Management Groups and/or SubscriptionsCreated a custom role with the following permissions: "notActions": [
"Microsoft.Management/managementGroups/delete",
"Microsoft.Management/managementGroups/write",
"Microsoft.Management/managementGroups/subscriptions/delete",
"Microsoft.Management/managementGroups/subscriptions/write",
]Attempted to rename a Management Group, and received the following error: Unfortunately, was still able to rename the Subscription. UpdateFound the following permission that's referenced when re-naming a Subscription: Added this to the PermissionsThe final set of custom permissions that work to cover this scenario is as follows: "notActions": [
"Microsoft.Management/managementGroups/delete",
"Microsoft.Management/managementGroups/write",
"Microsoft.Management/managementGroups/subscriptions/delete",
"Microsoft.Subscription/cancel/action",
"Microsoft.Subscription/rename/action"
] |
Scenario: Create any Express Route circuits, VPN sites, Route tables, VPN/NAT/Local GatewaysCreated a custom role with the following permissions: "notActions": [
"Microsoft.Network/expressRouteCircuits/*",
"Microsoft.Network/vpnSites/*",
"Microsoft.Network/vpnGateways/*",
"Microsoft.Network/virtualNetworkGateways/*",
"Microsoft.Network/natGateways/*",
"Microsoft.Network/localnetworkgateways/*",
"Microsoft.Network/connections/*",
"Microsoft.Network/routeTables/write"
]Express RouteAttempted to create an Express Route, and received the following error: NAT GatewayAttempted to create a NAT Gateway, and received the following error: Local GatewayAttempted to create a Local Gateway, and received the following error: Route TableAttempted to create a Route Table, and received the following error: |
Scenario: VNet PeeringCreated a custom role with the following permissions: "notActions": [
"Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
"Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write"
]Create New VNet PeeringAttempted to add a new VNet Peering, and received the following error: Modify Existing vHub VNet PeeringAttempted to modify the peering settings of the vHub Peering, and the Save button is greyed out/disabled. Delete Existing VNet PeeringAttempted to delete the existing vHub VNet Peering, and received the following error: Peer Non-Vending VNet with the vHubAttempted to peer a non-Vending VNet with the vHub, and received the following error: Peer Non-Vending VNet with the Vending VNetAttempted to peer a non-Vending VNet with the VNet that was created through the LZ Vending, and received the following error: |
Scenario: Changing the DNS server configurationAttempted various permeations of the following permissions: "notActions": [
"Microsoft.Network/virtualNetworks.properties.dhcpOptions.dnsServers"
]But it seems it is not possible to reference a property of an object for IAM permission control. However, discovered the following custom Community-based Azure Policies that control VNet DNS settings: UpdateCreated and deploy a customized version of the "Deny changing VNet DNS settings from pre-defined value" policy. Attempted to change the VNet DNS configuration (both to a different IP address, and setting it to "Default (Azure-provided)"), and received the following error: ImplementationTo implement this across different environments (ie. FORGE vs LIVE), we will need to create a custom Policy Definition, Policy Assignment, and use the |
Scenario: Not create a new VNet, but be still be able to modify an existing oneCreated a custom role with the following permissions: "actions": [
"*"
],
"notActions": [
"Microsoft.Network/virtualNetworks/write"
],Attempted to create a new VNet, and received the following error: Then attempted to modify an existing VNet (ie. add a Subnet to the existing LZ Vending VNet), and was able to do so successfully. |
Azure Policy AlternativesTo simplify RBAC, and remove the need to filter available Roles based, we want to identify if an Azure Policy (either built-in, or community created), can provide the same level of resource protection and restrictions. Note Tested the following Azure Policies with the User account being granted Contributor access at the Management Group level (ie. no custom RBAC role). Azure Policies
Custom Deny Networking Resource PolicyIf there are existing resources defined in this policy, the user is able to still view them, and can also make edits/changes. Only affects net-new. Deny VNet Peering PolicyAttempted to create a new VNet Peer. Prevents the creation of new peerings, and also blocks modification of existing peerings. However, it does not prevent deleting a VNet peering! Deny Creating VNetsNew VNet creation denied, but still able to add a subnet to an existing VNet. Also able to delete a subnet. Deny Modification of Diagnostics Settings PolicyWhen attempting to update the existing Note The When attempting to delete the existing |
Additional TestingWe need to test the following:
UpdatesDiagnosticsEven with Owner permissions, the error "does not have authorization to perform action 'Microsoft.Insights/register/action' over scope" is thrown. This is not caused by the Policy assignment though (as this error occurs even without the Policy being assigned). So, it does prevent modification of the Diagnostic Settings. But it does not prevent adding a new Diagnostic Setting (and being able to update and/or delete that one). VNet PeeringConfirmed that the Deny vNet peering policy does indicate the Hub peering as being out of compliance. Need to modify the policy to exclude this peering. Added the following to the Policy Rule, which ignores the VNet peering created for the Hub: {
"field": "name",
"like": "RemoteVnetToHubPeering*"
} |
|
Policy successfully deployed and applied in FORGE. Policies
Scenarios to test:
Scenario: New Project SetCreated request for new Project Set in FORGE ( |
|
Polices added to the shared CAF module, and deployed in FORGE. PR created for LIVE to apply the policies (in |
Out-of-the-box, the Cloud Adoption Framework (CAF), has the following custom roles defined:
These (or a customization of these roles) will be applied to various Security Groups, which end-users will be added to. In the future, this will be the supported method for granting and controlling access in Azure.
We need to evaluate these roles/permissions, to assess if any further customizations are required, and what the end-users can/cannot do. We can use the Azure built-in roles as a reference point.
Scenarios to Test
Preventative Scenarios
We don't want end users to...
Potential Customizations
In addition to what these custom roles provide out-of-the-box, we might consider the following customizations.
Identity
Microsoft.ManagedIdentity/*Network
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/deleteMicrosoft.Network/virtualNetworks/virtualNetworkPeerings/writeMicrosoft.Network/virtualNetworks.properties.dhcpOptions.dnsServers/write(unconfirmed path reference)Microsoft.Insights/DiagnosticSettings/setbypolicy/writeMicrosoft.Insights/DiagnosticSettings/setbypolicy/deleteMicrosoft.Network/natGateways/join/actionMicrosoft.Network/connections/writeMicrosoft.Network/localnetworkgateways/writeMicrosoft.Network/virtualNetworkGateways/writeThe text was updated successfully, but these errors were encountered: