output/20260723_081209/govviz/repo/pwsh/dev/functions/validateLeastPrivilegeForUser.ps1
|
function validateLeastPrivilegeForUser { $currentTask = "Validate least priviledge (Azure Resource side) for executing user $($azapicallConf['htParameters'].userObjectId)" $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Management/managementGroups/$($ManagementGroupId)/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&`$filter=principalId eq '$($azapicallConf['htParameters'].userObjectId)'" $method = 'GET' $getRoleAssignmentsForExecutingUserAtManagementGroupId = AzAPICall -AzAPICallConfiguration $azapicallConf -uri $uri -method $method -currentTask $currentTask $nonReaderRolesAssigned = ($getRoleAssignmentsForExecutingUserAtManagementGroupId.properties.RoleDefinitionId | Sort-Object -Unique).where({ $_ -notlike '*acdd72a7-3385-48ef-bd42-f606fba81ae7' }) if ($nonReaderRolesAssigned.Count -gt 0) { Write-Host '* * * LEAST PRIVILEGE ADVICE' -ForegroundColor DarkRed Write-Host 'The Azure Governance Visualizer script is executed with more permissions than required.' Write-Host "The executing identity '$($azapicallConf['checkContext'].Account.Id)' ($($azapicallConf['checkContext'].Account.Type)) Id: '$($azapicallConf['htparameters'].userObjectId)' has the following RBAC Role(s) assigned at Management Group scope '$ManagementGroupId':" foreach ($nonReaderRoleAssigned in $nonReaderRolesAssigned) { $currentTask = "Get RBAC Role definition '$nonReaderRoleAssigned'" $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)$($nonReaderRoleAssigned)?api-version=2022-04-01" $method = 'GET' $getRole = AzAPICall -AzAPICallConfiguration $azapicallConf -uri $uri -method $method -listenOn Content if ($getRole.properties.roleName -eq 'owner' -or $getRole.properties.roleName -eq 'contributor') { Write-Host " - $($getRole.properties.roleName) ($($getRole.properties.type)) !!!" } else { Write-Host " - $($getRole.properties.roleName) ($($getRole.properties.type))" } } Write-Host "The required Azure RBAC role at Management Group scope '$ManagementGroupId' is 'Reader' (acdd72a7-3385-48ef-bd42-f606fba81ae7)." Write-Host "Recommendation: consider executing the script in context of a Service Principal with least privilege. Review the Azure Governance Visualizer Setup Guide at 'https://github.com/Azure/Azure-Governance-Visualizer/blob/master/setup.md'" Write-Host ' * * * * * * * * * * * * * * * * * * * * * *' -ForegroundColor DarkRed Pause } else { Write-Host "Azure Governance Visualizer Least Privilege check (Azure Resource side) for executing identity '$($azapicallConf['checkContext'].Account.Id)' ($($azapicallConf['checkContext'].Account.Type)) Id: '$($azapicallConf['htparameters'].userObjectId)' succeeded" -ForegroundColor Green } } |