Disabling Role-Based Access Control (RBAC) on Azure resources can reduce an organization’s ability to protect itself against access controls being compromised.

To be considered safe, access controls must follow the principle of least privilege and correctly segregate duties amongst users. RBAC helps enforce these practices by adapting the organization’s access control needs into explicit role-based policies: It helps keeping access controls maintainable and sustainable.

Furthermore, RBAC allows operations teams to work faster during a security incident. It helps to mitigate account theft or intrusions by quickly shutting down accesses.

Ask Yourself Whether

• This Azure resource is essential for the information system infrastructure.
• This Azure resource is essential for mission-critical functions.
• Compliance policies require access to this resource to be enforced through the use of Role-Based Access Control.

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

• Enable Azure RBAC when the Azure resource supports it.
• For Kubernetes clusters, enable Azure RBAC if Azure AD integration is supported. Otherwise, use the built-in Kubernetes RBAC.

Sensitive Code Example

For AKS Azure Kubernetes Service:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.ContainerService/managedClusters",
      "apiVersion": "2023-03-01",
      "properties": {
        "aadProfile": {
          "enableAzureRBAC": false
        },
        "enableRBAC": false
      }
    }
  ]
}

For Key Vault:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults",
      "apiVersion": "2022-07-01",
      "properties": {
        "enableRbacAuthorization": false
      }
    }
  ]
}

Compliant Solution

For AKS Azure Kubernetes Service:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.ContainerService/managedClusters",
      "apiVersion": "2023-03-01",
      "properties": {
        "aadProfile": {
          "enableAzureRBAC": true
        },
        "enableRBAC": true
      }
    }
  ]
}

For Key Vault:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults",
      "apiVersion": "2022-07-01",
      "properties": {
        "enableRbacAuthorization": true
      }
    }
  ]
}

See

• OWASP Top 10 2021 Category A1 - Boken Access Control
• OWASP Top 10 2017 Category A5 - Broken Access Control
• MITRE, CWE-668 - Exposure of Resource to Wrong Sphere