Analyze Azure Resource Manager (ARM) JSON templates and Bicep-compiled ARM documents to find Microsoft.Authorization/roleAssignments resources that grant high-privilege built-in Azure roles such as Owner, Contributor, User Access Administrator, Privileged Role Administrator, or Role Based Access Control Administrator, and emit findings, counts, and remediation guidance based on least-privilege principles.
Analyze Azure Resource Manager (ARM) JSON templates and Bicep-compiled ARM documents to find Microsoft.Authorization/roleAssignments resources that grant high-privilege built-in Azure roles such as Owner, Contributor, User Access Administrator, Privileged Role Administrator, or Role Based Access Control Administrator, and emit findings, counts, and remediation guidance based on least-privilege principles.
Installation
bash
# Install from registry
codemod run @codemod/arm-detect-high-privilege-role-assigns
# Or run locally
codemod workflow run -w workflow.yaml -t /path/to/arm-json-root
Usage
This is a read-only mining codemod. It does not rewrite source files.
It scans **/*.json files under the target directory and recursively inspects:
Top-level resources[]
Child resources[] arrays at any depth
Embedded nested templates under resources[].properties.template
It reports one finding per Microsoft.Authorization/roleAssignments resource when properties.roleDefinitionId resolves to one of these built-in role GUIDs:
e8611ab8-c189-46e8-94e1-60213ab1f814 (Privileged Role Administrator)
f58310d9-a9f6-439a-9e8d-f62e7b41a168 (Role Based Access Control Administrator)
Supported roleDefinitionId resolution includes:
Literal GUIDs
Full role definition resource IDs
subscriptionResourceId(...)
tenantResourceId(...)
extensionResourceId(...) when the GUID argument is deterministic
concat(...) and format(...) patterns that deterministically build the role definition path
variables(...) and parameters(...) indirections when they resolve locally to a single deterministic value
Each emitted finding includes file path, JSON path, resource name when present, normalized role GUID and name, raw roleDefinitionId, inferred scope information, optional principal metadata, optional condition fields, and remediation guidance. Findings are emitted as structured runtime warnings, and aggregate counters are emitted through codemod:metrics.
Excluded cases:
Custom roles that do not match the built-in GUID allowlist
Unresolved parameter or variable indirections
Authorization resource types other than role assignments
Raw .bicep files, because the workflow only targets compiled ARM JSON
Development
bash
# Test the read-only analyzer and metrics snapshots
pnpm test
# Type-check the codemod
pnpm check-types
# Validate the package
npx codemod ai call validate_codemod_package --input '{"package_path":".","run_default_test":true,"run_check_types":true}'
# Publish to registry
codemod login
codemod publish
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.