Azure subscriptions with custom roles does not have minimum permissions misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_39
Category - Subcategory	IAM - Overly Permissive
Provider	AZURE
Severity	HIGH
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Ensure that no custom subscription owner roles are created

How to Fix

Option 1

• Resource: azurerm_role_definition
• Arguments: actions

Option 2

• Resource: azurerm_role_definition
• Arguments: assignable_scopes [source,go]

---

resource "azurerm_role_definition" "example" { name = "my-custom-role" scope = data.azurerm_subscription.primary.id description = "This is a custom role created via Terraform"

permissions { actions = [

• "*"

] not_actions = [] }

assignable_scopes = [ "/" ] }

resource "azurerm_role_definition" "example" { name = "my-custom-role" scope = data.azurerm_subscription.primary.id description = "This is a custom role created via Terraform" permissions { actions = [ "*" ] not_actions = [] }

assignable_scopes = [

• "/"
• data.azurerm_subscription.primary.id
• resource.azurerm_subscription.primary.id ] }

---