Ccodemod

codemod/arm-detect-high-privilege-role-assigns

Analyze Azure Resource Manager (ARM) JSON templates and Bicep-compiled ARM documents to find Microsoft.Authorization/roleAssignments resources that grant high-privilege built-in Azure roles such as Owner, Contributor, User Access Administrator, Privileged Role Administrator, or Role Based Access Control Administrator, and emit findings, counts, and remediation guidance based on least-privilege principles.

securitycode-miningazurearm
Public
0 executions
Use dashboard
Apply to Repository

Run locally

npx codemod @codemod/arm-detect-high-privilege-role-assigns

@codemod/arm-detect-high-privilege-role-assigns

Analyze Azure Resource Manager (ARM) JSON templates and Bicep-compiled ARM documents to find Microsoft.Authorization/roleAssignments resources that grant high-privilege built-in Azure roles such as Owner, Contributor, User Access Administrator, Privileged Role Administrator, or Role Based Access Control Administrator, and emit findings, counts, and remediation guidance based on least-privilege principles.

Installation

bash

Usage

This is a read-only mining codemod. It does not rewrite source files.

It scans **/*.json files under the target directory and recursively inspects:

  • Top-level resources[]
  • Child resources[] arrays at any depth
  • Embedded nested templates under resources[].properties.template

It reports one finding per Microsoft.Authorization/roleAssignments resource when properties.roleDefinitionId resolves to one of these built-in role GUIDs:

  • 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 (Owner)
  • b24988ac-6180-42a0-ab88-20f7382dd24c (Contributor)
  • f1a07417-d97a-45cb-824c-7a7467783830 (User Access Administrator)
  • e8611ab8-c189-46e8-94e1-60213ab1f814 (Privileged Role Administrator)
  • f58310d9-a9f6-439a-9e8d-f62e7b41a168 (Role Based Access Control Administrator)

Supported roleDefinitionId resolution includes:

  • Literal GUIDs
  • Full role definition resource IDs
  • subscriptionResourceId(...)
  • tenantResourceId(...)
  • extensionResourceId(...) when the GUID argument is deterministic
  • concat(...) and format(...) patterns that deterministically build the role definition path
  • variables(...) and parameters(...) indirections when they resolve locally to a single deterministic value

Each emitted finding includes file path, JSON path, resource name when present, normalized role GUID and name, raw roleDefinitionId, inferred scope information, optional principal metadata, optional condition fields, and remediation guidance. Findings are emitted as structured runtime warnings, and aggregate counters are emitted through codemod:metrics.

Excluded cases:

  • Custom roles that do not match the built-in GUID allowlist
  • Unresolved parameter or variable indirections
  • Authorization resource types other than role assignments
  • Raw .bicep files, because the workflow only targets compiled ARM JSON

Development

bash

License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community