microsoft / microsoft/AzureTRE
API's VM Contributor permissions are too wide
Open
Nobody has claimed this yet.
api
bug
- Dominant language
- Python
- Stars
- 235
- Forks
- 192
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 13
Description
Describe the bug
We give Virtual Machine Contributor permission to the API identity and that is too wide. For instance, it gets full access to all storage accounts in the subscription.
A couple of options I see:
- Remove the subscription level permission - not sure we event need it that wide and move to a workspace RG level one. Or even on the resource itself
- Create a custom role that we can use together with the first point.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files or tests are identified. Start by reviewing the API identity's current Azure Virtual Machine Contributor assignment and the linked built-in role documentation; determine the minimum required scope and permissions, then document a decided replacement that removes unnecessary subscription-wide access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- authorization, cloud, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100