Feature Request - AzOps IAM security guidance for least privilege access
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 20/100
- Issue type
- Documentation
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- azure, powershell
- Domain
- cloud, documentation, security
Research direction
Start by reading the AzOps operating guidance and the linked Microsoft privileged-access and Enterprise-Scale references. Establish what security and least-privilege guidance is missing for AzOps and how it relates to the Enterprise Access Model. Done means a reviewed documentation update that answers the requested best-practice questions and clearly identifies any remaining limitations.
Written by the indexing model from the issue text.
Description
The security concept around AzOps is questionable. It basically breaks with all of Microsoft's recommendations around least privileges. You have a single pipeline with permissions to manage more or less everything. This includes granting permissions on MG level, e.g. on Platform Identity -> bye bye Domain Controller(s).
Where access to DC was highly restricted on-prem and also should be it according to your ALZ architecture if moved to the cloud, the AzOps completely circumvents this unless the approver is from the same DC admin team and can read code to understand the request to approve. The same for other resources and services.
It seems like AzOps only serves an operational purpose without security being thought through. The suspicion is only strengthened by AzOps never mentioning security as a factor.
What is best practice and Microsoft recommendations around AzOps and security?
How can we ensure that Enterprise Access Model is still valid?
Source:
- https://github.com/Azure/Enterprise-Scale/wiki/Deploying-ALZ-Platform-DevOps#operating-the-azure-platform-using-azops-infrastructure-as-code-with-github-actions
- https://learn.microsoft.com/en-us/security/compass/privileged-access-access-model
- https://learn.microsoft.com/en-us/security/compass/privileged-access-strategy
- https://github.com/azure/azops
- Dominant language
- PowerShell
- Stars
- 420
- Forks
- 174
- Avg merge
- 16d 18h
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Azure/AzOps
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 3/5 1-2 days Newbie friendliness 78/100
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
-
Difficulty 4/5 3-5 days Newbie friendliness 28/100
Similar issues
-
Language: Terraform :globe_with_meridians: Needs: Triage :mag: Type: Bug :bug:
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Azure/terraform-azurerm-avm-res-containerregistry-registry#230 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100