Control: Use of the 'User Access Administrator' role should be restricted

Description

The User Access Administrator role grants the ability to view all resources and manage access assignments at any subscription or management group level within the tenant. Due to its high privilege level, this role assignment should be removed immediately after completing the necessary changes at the root scope to minimize security risks.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.iam_user_access_administrator_role_restricted

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.iam_user_access_administrator_role_restricted --share

SQL

This control uses a named query:

with user_access_admin_role as (
  select
    id,
    role_name,
    subscription_id
  from
    azure_role_definition
  where
    role_name = 'User Access Administrator'
)
select
  ra.id as resource,
  case
    when r.role_name is not null then 'alarm'
    else 'ok'
  end as status,
  case
    when r.role_name is not null then ra.subscription_id || ' has User Access Administrator role assigned at scope ' || ra.scope
    else 'No User Access Administrator role assignments found.'
  end as reason
  
  , sub.display_name as subscription
from
  azure_role_assignment ra
  left join user_access_admin_role r on ra.role_definition_id = r.id
  left join azure_subscription sub on sub.subscription_id = ra.subscription_id
where
  r.role_name is not null;

Control: Use of the 'User Access Administrator' role should be restricted

Description

Usage

SQL

Tags