@codemod/arm-no-custom-role-owner-capabilities
Analyze Azure Resource Manager templates and related Azure custom role definitions to detect custom roles whose assignable scope or allowed actions effectively grant subscription Owner capabilities, then emit findings, counts, and remediation guidance without modifying files.
What It Detects
This codemod scans JSON files for:
- ARM
Microsoft.Authorization/roleDefinitionsresources, including nested deployment templates - Standalone Azure custom role definition documents with
permissionsandassignableScopes
It flags custom roles when both of these are true:
assignableScopesincludes subscription scope such as/subscriptions/<id>or clear ARM-expression equivalents like[subscription().id]- management-plane permissions are broad enough to approximate subscription Owner capabilities, including
*,Microsoft.Authorization/*, role definition administration, or broad provider wildcards paired with privilege-escalation paths
It does not rewrite source files. It emits findings and the following metrics:
arm_custom_role_definitions_scannedarm_custom_role_subscription_scope_rolesarm_custom_role_owner_equivalent_findingsarm_custom_role_owner_equivalent_by_triggerarm_custom_role_suspicious_action_entriesarm_custom_role_dynamic_unresolvedarm_custom_role_notactions_mitigatedarm_custom_role_files_with_findings
Exclusions
- Built-in role references and
Microsoft.Authorization/roleAssignmentsresources without an inlined custom role definition - Resource-group-only or management-group-only roles without subscription scope
- Data-plane-only
dataActionspatterns without broad management-plane actions - Role names alone such as
OwnerorAdminwithout permission-based evidence
Usage
Each finding includes severity, confidence, file path, JSON pointer, role name, resource name or id, assignable scopes, actions, notActions, matched trigger types, and remediation guidance.
Stable trigger types emitted by this codemod:
wildcard_actionauthorization_wildcardrole_assignments_adminrole_definitions_admincomposite_broad_admindynamic_subscription_scope
Development
License
MIT