Review Azure role permissions for guest users

Description

Guest users receive the permissions of their assigned Azure roles. Naming a user or role Guest does not automatically restrict resource permissions.

Potential impact

Broad permissions on an external collaboration account can enable unintended resource changes if the account is misused or compromised.

Remediation

Allow only required actions in custom roles and narrow assignment scope. Review all assignments because not_actions does not deny permissions granted by another role.

Examples

The examples use an explicit guest object ID and narrow all-action access to reading information about one resource group.

Before

hcl

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.primary.id
  description = "This is a custom role created via Terraform"

  permissions {
    actions     = ["*"]
    not_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.primary.id,
  ]
}

resource "azurerm_role_assignment" "example" {
  name                 = "00000000-0000-0000-0000-000000000000"
  scope                = data.azurerm_subscription.primary.id
  role_definition_id   = azurerm_role_definition.example.role_definition_resource_id
  principal_id         = var.guest_object_id
}

After

hcl

resource "azurerm_role_definition" "example" {
  name        = "my-custom-role"
  scope       = data.azurerm_subscription.primary.id
  description = "This is a custom role created via Terraform"

  permissions {
    actions     = ["Microsoft.Resources/subscriptions/resourceGroups/read"]
    not_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.primary.id,
  ]
}

resource "azurerm_role_assignment" "example" {
  name                 = "00000000-0000-0000-0000-000000000000"
  scope                = var.resource_group_id
  role_definition_id   = azurerm_role_definition.example.role_definition_resource_id
  principal_id         = var.guest_object_id
}