Control: 5.3.7 Ensure all non-privileged role assignments are periodically reviewed
Description
Perform a periodic review of non-privileged role assignments to ensure that the nonprivileged roles assigned to users are appropriate.
Note: Determining 'appropriate' assignments requires a clear understanding of your organization's personnel, systems, policies, and security requirements. This cannot be effectively prescribed in a procedure.
Remediation
Remediate from Azure Portal
- Go to
Subscriptions. - Click the name of a subscription.
- Click
Access control (IAM). - Click
Role assignments. - Click
Job function roles. - Check the box next to any inappropriate assignments.
- Click
Delete. - Click
Yes. - Repeat steps 1-8 for each subscription
Default Value
Users do not have non-privileged roles assigned to them by default.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_3_7Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_3_7 --shareSQL
This control uses a named query:
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;