TMA-AZURE-5.7

Ensure there are between 2 and 3 Subscription Owners

높음레벨 1수동 검토azure

설명

The Owner role in Azure grants full control over all resources in a subscription, including the ability to assign roles to others. Limit the number of security principals (users, groups, service principals, and managed identities) assigned the Owner role to between 2 and 3. If groups are used, ensure their membership is tightly controlled and regularly reviewed to avoid privilege sprawl.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Audit from Azure Portal 1. Go to Subscriptions. 2. Click the name of a subscription. 3. Click Access Controls (IAM). 4. Click Role assignments. 5. Click Role : All. 6. Click the arrow next to All. 7. Click Owner. 8. Ensure a minimum of 2 and a maximum of 3 members are returned. 9. Repeat steps 1-8 for each subscription. Audit from Azure CLI Run the following command to list members with role Owner at a given subscription scope: az role assignment list --role Owner --scope /subscriptions/<subscription-id> --query "[].{PrincipalName:principalName, Type:principalType}" Ensure a minimum of 2 and a maximum of 3 members are returned. For each Owner assignment, check: If principalType == Group, review group membership. If principalType == ServicePrincipal or ManagedIdentity, validate necessity and scope. Repeat for each subscription. Audit from PowerShell Run the following command to list members with role Owner at a given subscription scope: Get-AzRoleAssignment -RoleDefinitionName Owner -Scope /subscriptions/<subscription-id> Ensure a minimum of 2 and a maximum of 3 members are returned. Repeat for each subscription. Audit from Azure Policy If referencing a digital copy of this Bench...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remediate from Azure Portal 1. Go to Subscriptions. 2. Click the name of a subscription. 3. Click Access Controls (IAM). 4. Click Role assignments. 5. Click Role : All. 6. Click the arrow next to All. 7. Click Owner. 8. Check the box next to members from whom the owner role should be removed. 9. Click Delete. 10. Click Yes. 11. Repeat steps 1-10 for each subscription requiring remediation. Remediate from Azure CLI Run the following command to delete role assignments by role assignment id: az role assignment delete --ids <role-assignment-ids>

속성

운영 체제: 모두
태그: azurecloud
참고 자료: CIS Microsoft Azure Foundations Benchmark v6.0.0 - 5.7 Ensure there are between 2 and 3 Subscription Owners