aquasecurity / aquasecurity/cloudsploit

Unable to fetch `listQueuesSegmented` in `plugins/azure/queueservice/queueServiceAllAccessAcl.js`

Open
#519 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

Hello everyone,

i have an issue regarding plugin `queueServiceAllAccessAcl`.
Which steps need to be configured to run this plugin successfully?

### Expected behaviour
As a developer i would expect to get the data of `listQueuesSegmented`.

**Service account has following role assignments:**
- Security Reader
- Log Analytics Reader
- Storage Account Key Operator Service Role

Information about which permissions are mandatory provided by [Azure configuration README](https://github.com/aquasecurity/cloudsploit/blob/master/docs/azure.md#cloud-provider-configuration) and [Cloudsploit freshdesk ticket](https://cloudsploit.freshdesk.com/support/solutions/articles/17000104617-azure-storage-account-file-service-queue-service-table-service-unknown-results)

### Actual behaviour
Getting 403 authorization failure.
```
"/subscriptions/XXXXXXXXX/resourceGroups/XXXXXX/providers/Microsoft.Storage/storageAccounts/XXXXXX": {
"err": {
"name": "StorageError",
"message": "This request is not authorized to perform this operation.\nRequestId:9309aa61-0003-0106-4e74-f54270000000\nTime:2021-01-28T12:56:11.2086459Z",
"code": "AuthorizationFailure",
"statusCode": 403,
"requestId": "9309aa61-0003-0106-4e74-f54270000000"
}
}
```

Does anybody have similar issue and can help me out?

Thanks

Contributor guide

Open the contributing guide

Research direction

Start with plugins/azure/queueservice/queueServiceAllAccessAcl.js and trace the listQueuesSegmented call, then review the Azure configuration README and linked Freshdesk guidance. Reproduce the reported 403 AuthorizationFailure with the listed role assignments and determine what configuration or permission is missing. Done means the plugin can retrieve listQueuesSegmented data without the authorization error.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, javascript
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.