Handle RBAC propagation when an already-granted permission is denied
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 35/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- azure, go
- 领域
- authorization, cloud, security
调研方向
从 TestTerraformACIWithInitialPermissions 开始，跟踪它所执行的授权失败解析、权限去重和角色更新路径。使用验收标准定义完成条件：正确处理大小写变体和混合操作，在不改变角色的情况下限制传播重试次数，并为恢复输入、过滤和超时添加单元测试覆盖。
由索引模型根据 Issue 内容生成。
描述
Summary
MPF can receive an Azure AuthorizationFailed response for an action already present in the service principal's newly assigned custom role while Azure RBAC assignment or role-definition changes are still propagating.
MPF currently treats the response as a newly discovered permission, appends it to the result, updates the role, and increments the discovery iteration. Permission action strings are also compared and deduplicated case-sensitively, so variants such as:
Microsoft.Resources/subscriptions/resourcegroups/read
Microsoft.Resources/subscriptions/resourceGroups/read
can be returned as two permissions even though Azure RBAC action names are case-insensitive.
Evidence
TestTerraformACIWithInitialPermissions supplies all nine expected permissions initially but intermittently completes with one discovery iteration and ten raw permissions:
- 33682617228 — AzureRM 5.3.0
- 34059711895 — AzureRM 5.4.0
- 34404410581 — AzureRM 5.4.0
- 34529691278 — AzureRM 5.5.0
The initial custom role includes Microsoft.Resources/subscriptions/resourcegroups/read. After the five-second post-assignment wait, AzureRM can receive a 403 for Microsoft.Resources/subscriptions/resourceGroups/read. MPF records the differently cased action as new, updates the role, waits again, and succeeds.
Passing runs with the same provider versions demonstrate that the trigger is intermittent RBAC propagation rather than a new provider permission. The behavior predates Go 1.27.
Related to #231, which tracks eventual consistency after role detachment. This issue focuses on propagation after initial assignment and subsequent role updates.
Proposed behavior
- Treat Azure RBAC action names as case-insensitive across result deduplication, role membership checks, invalid-action filtering, and resume-from-file inputs.
- Define and preserve a stable canonical spelling in user-facing results.
- When parsing authorization failures, split actions into already-granted and genuinely missing sets using case-insensitive comparisons.
- Retry without role mutation or discovery-iteration increment only when all parsed actions are already granted at the relevant assignment scope.
- If any parsed action is genuinely missing, add only those actions and continue normal discovery.
- Account for wildcard actions,
NotActions, deny assignments, and assignment scope so persistent denials are not misclassified as propagation lag. - Use bounded backoff with a separate propagation-retry counter and return an explicit timeout error.
- Apply the behavior after initial role assignment and subsequent role-definition updates.
- Avoid mutating caller-provided permission slice backing arrays while building updated roles.
Acceptance criteria
- Casing variants of one Azure action appear once in MPF results and resume files.
- A temporary denial for an already-granted action does not mutate the role or increment the discovery count.
- Mixed authorization errors still add genuinely missing permissions.
- Scope, wildcard,
NotActions, and persistent-denial cases do not silently retry as propagation lag. - Retries are bounded, separately accounted for, and timeout failures are explicit.
- Unit tests cover casing variants, eventual success, mixed actions, resume input, invalid-action filtering, and timeout behavior.
- Existing genuine permission discovery remains unchanged.
A separate test-only PR will stabilize Terraform E2E assertions while this product behavior is designed and implemented. The E2E tolerance will remain visible in logs so this issue can track whether propagation lag continues occurring.
- 主要语言
- Go
- 星标
- 66
- 派生
- 11
- 平均合并
- 2 天 9 小时
- 30 天内合并 PR
- 5
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
Azure/mpf 的其他 Issue
-
bug
难度 1/5 1 小时以内 新手友好度 88/100
维护者通常 1 天内回复
-
CreateUpdateCustomRole returns nil after exhausting its retry budget, reporting success when the role was never updated可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭bug
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
govulncheck: vulnerabilities detected on main可能已有人在做 @maniSbindra 于 6 天前认领。 未关闭govulncheck
难度 3/5 半天 新手友好度 40/100
Azure/mpf#345 · 1 个 reaction · 已指派 2 人 ·
维护者通常 1 天内回复
-
E2E Tests: Intermittent TestTerraformModuleTest failures due to stale RBAC permissions from previous test可能已有人在做 @maniSbindra 于 234 天前认领。 未关闭bug
Azure/mpf#231 · 6 条评论 · 1 个 reaction · 已指派 2 人 ·
维护者通常 1 天内回复
-
Add optional flag which does not destroy the resources created including the custom role definition可能重新可做 关联的 PR 已关闭且未合并。 未关闭enhancement terraform
Azure/mpf#84 · 1 个 reaction · 已指派 1 人 ·
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
cloudflare/terraform-provider-cloudflare#7423 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
router-for-me/CLIProxyAPI#6746 · 2 条评论 ·
维护者通常 1 天内回复
-
ViewData can pair the in-flight proposal with the prepared flag of another proposal可能已有人在做 @HagarMeir 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
hyperledger/SmartBFT#710 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100