Analyze Azure Resource Manager templates and related Azure custom role definitions to detect custom roles whose assignable scope or allowed actions effectively grant subscription Owner capabilities, then emit findings, counts, and remediation guidance without modifying files.
Analyze Azure Resource Manager templates and related Azure custom role definitions to detect custom roles whose assignable scope or allowed actions effectively grant subscription Owner capabilities, then emit findings, counts, and remediation guidance without modifying files.
What It Detects
This codemod scans JSON files for:
ARM Microsoft.Authorization/roleDefinitions resources, including nested deployment templates
Standalone Azure custom role definition documents with permissions and assignableScopes
It flags custom roles when both of these are true:
assignableScopes includes subscription scope such as /subscriptions/<id> or clear ARM-expression equivalents like [subscription().id]
management-plane permissions are broad enough to approximate subscription Owner capabilities, including *, Microsoft.Authorization/*, role definition administration, or broad provider wildcards paired with privilege-escalation paths
It does not rewrite source files. It emits findings and the following metrics:
arm_custom_role_definitions_scanned
arm_custom_role_subscription_scope_roles
arm_custom_role_owner_equivalent_findings
arm_custom_role_owner_equivalent_by_trigger
arm_custom_role_suspicious_action_entries
arm_custom_role_dynamic_unresolved
arm_custom_role_notactions_mitigated
arm_custom_role_files_with_findings
Exclusions
Built-in role references and Microsoft.Authorization/roleAssignments resources without an inlined custom role definition
Resource-group-only or management-group-only roles without subscription scope
Data-plane-only dataActions patterns without broad management-plane actions
Role names alone such as Owner or Admin without permission-based evidence
Usage
bash
# Run locally against a target repository
pnpm dlx codemod@latest workflow run -w . --target ../target-repo
# Run tests
pnpm test
Each finding includes severity, confidence, file path, JSON pointer, role name, resource name or id, assignable scopes, actions, notActions, matched trigger types, and remediation guidance.
Stable trigger types emitted by this codemod:
wildcard_action
authorization_wildcard
role_assignments_admin
role_definitions_admin
composite_broad_admin
dynamic_subscription_scope
Development
bash
# Test the analysis codemod
pnpm test
# Validate the workflow
pnpm dlx codemod@latest workflow validate -w .
# Type-check the codemod
pnpm check-types
# Publish to registry
pnpm dlx codemod@latest login
pnpm dlx codemod@latest publish
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.