InsightCloudSec Docs

Welcome to the InsightCloudSec Docs!

InsightCloudSec by Rapid7 (formerly DivvyCloud) is a Cloud-Native Security Platform that provides real-time analysis and automated remediation for continuous security and compliance for your multi-cloud environment.

For questions reach out to us through [email protected].

Take Me to the Docs!    Release Notes

Microsoft Azure - Custom Roles

Suggest Edits

Overview

This article details how to create or customize roles within Microsoft Azure. For most uses with DivvyCloud, though, using the Azure-created roles is appropriate.

Prerequisite Roles

To access services through the DivvyCloud tool, we recommend using either a read-only role or a power-user role.

If you are interested in operating in a read-only fashion, which will prevent DivvyCloud from taking actions against your Microsoft Azure resources, then we recommend using the DivvyCloud Standard User role. This role will grant DivvyCloud read-only permissions to supported resources, so that it can harvest data and report on it.

If you would like to use DivvyCloud to manage your Microsoft Azure resources directly or through the use of Bots, then use the DivvyCloud Power User role. DivvyCloud Power User will grant DivvyCloud all permissions to supported resources so it can act upon cloud resources in addition to monitoring and reporting on them.

You may wish to start with DivvyCloud Standard User until you are more familiar with how to use DivvyCloud and then change to DivvyCloud Power User when you are ready to use all of DivvyCloud’s capabilities.

📘

Note

The "Microsoft.ContainerRegistry/registries/pull/read" permission is included in the power user, standard user, and reader plus roles as it needs to be explicit if not using one of the built-in Owner, Contributor, or AcrPull roles.

DivvyCloud Standard User Role

❗️

Assignable Scopes

Note the "AssignableScopes" at the bottom of this file will need to be slightly different if you're configuring an Azure Organization.

{
    "Name": "DivvyCloud Standard User",
    "Id": null,
    "IsCustom": true,
    "Description": "Provides read-only access to resources supported by DivvyCloud.",
    "Actions": [
        "Microsoft.Advisor/recommendations/read",
        "Microsoft.Authorization/classicAdministrators/read", 
        "Microsoft.Authorization/locks/read",
        "Microsoft.Authorization/policyAssignments/read",
        "Microsoft.Authorization/policyDefinitions/read",
        "Microsoft.Authorization/policySetDefinitions/read",
        "Microsoft.Authorization/roleAssignments/read",
        "Microsoft.Authorization/roleDefinitions/read",
        "Microsoft.Batch/batchAccounts/read",
        "Microsoft.Batch/batchAccounts/pools/read",
        "Microsoft.Cache/redis/read",
        "Microsoft.Cache/redis/firewallRules/read",
        "Microsoft.Compute/disks/read",
        "Microsoft.Compute/galleries/read",
        "Microsoft.Compute/galleries/images/read",
        "Microsoft.Compute/galleries/images/versions/read",
        "Microsoft.Compute/hostGroups/read",
        "Microsoft.Compute/images/read",
        "Microsoft.Compute/skus/read",
        "Microsoft.Compute/snapshots/read",
        "Microsoft.Compute/virtualMachineScaleSets/extensions/read",
        "Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
        "Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
        "Microsoft.Compute/virtualMachineScaleSets/publicIPAddresses/read",
        "Microsoft.Compute/virtualMachineScaleSets/read",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/extensions/read",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/publicIPAddresses/read",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/read",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read",
        "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
        "Microsoft.Compute/virtualMachines/extensions/read",
        "Microsoft.Compute/virtualMachines/instanceView/read",
        "Microsoft.Compute/virtualMachines/read",
        "Microsoft.ContainerInstance/containerGroups/read",
        "Microsoft.ContainerRegistry/registries/pull/read",
        "Microsoft.ContainerRegistry/registries/read",
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.Databricks/workspaces/read",
        "Microsoft.DataFactory/factories/read",
        "Microsoft.DataLakeStore/accounts/read",
        "Microsoft.DBforMariaDB/locations/performanceTiers/read",
        "Microsoft.DBforMariaDB/performanceTiers/read",
        "Microsoft.DBforMariaDB/servers/configurations/read",
        "Microsoft.DBforMariaDB/servers/firewallRules/read",
        "Microsoft.DBforMariaDB/servers/read",
        "Microsoft.DBforMariaDB/servers/virtualNetworkRules/read",
        "Microsoft.DBforMySQL/locations/performanceTiers/read",
        "Microsoft.DBforMySQL/performanceTiers/read",
        "Microsoft.DBforMySQL/servers/administrators/read",         
        "Microsoft.DBforMySQL/servers/configurations/read",
        "Microsoft.DBforMySQL/servers/firewallRules/read",
        "Microsoft.DBforMySQL/servers/keys/read",
        "Microsoft.DBforMySQL/servers/read",
        "Microsoft.DBforMySQL/servers/virtualNetworkRules/read",     
        "Microsoft.DBforPostgreSQL/locations/performanceTiers/read",
        "Microsoft.DBforPostgreSQL/performanceTiers/read",
        "Microsoft.DBforPostgreSQL/servers/administrators/read",       
        "Microsoft.DBforPostgreSQL/servers/configurations/read",
        "Microsoft.DBforPostgreSQL/servers/firewallRules/read",
        "Microsoft.DBforPostgreSQL/servers/keys/read",
        "Microsoft.DBforPostgreSQL/servers/read",
        "Microsoft.DBforPostgreSQL/servers/virtualNetworkRules/read",
        "Microsoft.DocumentDB/databaseAccounts/read",
        "Microsoft.DocumentDB/databaseAccounts/usages/read",
        "Microsoft.EventHub/namespaces/eventhubs/read",
        "Microsoft.EventHub/namespaces/networkruleset/read",
        "Microsoft.EventHub/namespaces/networkrulesets/read",
        "Microsoft.EventHub/namespaces/read",
        "Microsoft.HDInsight/clusters/read",
        "Microsoft.Insights/DiagnosticSettings/Read",
        "Microsoft.Insights/LogProfiles/read",
        "Microsoft.KeyVault/vaults/read",
        "Microsoft.Logic/workflows/read",
        "Microsoft.Network/applicationGateways/read",
        "Microsoft.Network/azurefirewalls/read",
        "Microsoft.Network/dnszones/A/read",
        "Microsoft.Network/dnszones/AAAA/read",
        "Microsoft.Network/dnszones/CAA/read",
        "Microsoft.Network/dnszones/CNAME/read",
        "Microsoft.Network/dnszones/MX/read",
        "Microsoft.Network/dnszones/NS/read",
        "Microsoft.Network/dnszones/PTR/read",
        "Microsoft.Network/dnszones/SOA/read",
        "Microsoft.Network/dnszones/SRV/read",
        "Microsoft.Network/dnszones/TXT/read",
        "Microsoft.Network/dnszones/read",
        "Microsoft.Network/dnszones/recordsets/read",
        "Microsoft.Network/expressRouteCircuits/read",
        "Microsoft.Network/frontDoors/read",
        "Microsoft.Network/ipGroups/read",
        "Microsoft.Network/loadBalancers/backendAddressPools/read",
        "Microsoft.Network/loadBalancers/frontendIPConfigurations/read",
        "Microsoft.Network/loadBalancers/networkInterfaces/read",
        "Microsoft.Network/loadBalancers/read",
        "Microsoft.Network/locations/usages/read",
        "Microsoft.Network/natGateways/read",
        "Microsoft.Network/networkInterfaces/read",
        "Microsoft.Network/networkSecurityGroups/read",
        "Microsoft.Network/networkWatchers/configureFlowLog/action", 
        "Microsoft.Network/networkWatchers/flowLogs/read",
        "Microsoft.Network/networkWatchers/queryFlowLogStatus/action",
        "Microsoft.Network/networkWatchers/read",
        "Microsoft.Network/privateDnsZones/A/read",
        "Microsoft.Network/privateDnsZones/AAAA/read",
        "Microsoft.Network/privateDnsZones/CNAME/read",
        "Microsoft.Network/privateDnsZones/MX/read",
        "Microsoft.Network/privateDnsZones/PTR/read",
        "Microsoft.Network/privateDnsZones/SOA/read",
        "Microsoft.Network/privateDnsZones/SRV/read",
        "Microsoft.Network/privateDnsZones/TXT/read",
        "Microsoft.Network/privateDnsZones/read",
        "Microsoft.Network/privateDnsZones/recordsets/read",
        "Microsoft.Network/privateDnsZones/virtualNetworkLinks/read",
        "Microsoft.Network/privateEndpoints/read",
        "Microsoft.Network/publicIPAddresses/read",
        "Microsoft.Network/routeTables/read",
        "Microsoft.Network/serviceEndpointPolicies/read",
        "Microsoft.Network/virtualNetworks/read",
        "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
        "Microsoft.Network/virtualnetworks/read",
        "Microsoft.OperationalInsights/workspaces/read",
        "Microsoft.Resources/subscriptions/locations/read",
        "Microsoft.Resources/subscriptions/providers/read",
        "Microsoft.Resources/subscriptions/resourceGroups/read",
        "Microsoft.Resources/subscriptions/resourcegroups/resources/read",
        "Microsoft.Search/searchServices/read",
        "Microsoft.Security/advancedThreatProtectionSettings/read",
        "Microsoft.Security/alerts/read",
        "Microsoft.Security/assessments/read",
        "Microsoft.Security/autoProvisioningSettings/read",
        "Microsoft.Security/locations/jitNetworkAccessPolicies/read",
        "Microsoft.Security/pricings/read",
        "Microsoft.Security/securityContacts/read",
        "Microsoft.Security/tasks/read",
        "Microsoft.ServiceBus/namespaces/networkRuleSets/read",
        "Microsoft.ServiceBus/namespaces/queues/read",
        "Microsoft.ServiceBus/namespaces/read",
        "Microsoft.Sql/managedInstances/administrators/read",
        "Microsoft.Sql/managedInstances/encryptionProtector/read",
        "Microsoft.Sql/managedInstances/read",
        "Microsoft.Sql/managedInstances/securityAlertPolicies/read",
        "Microsoft.Sql/managedInstances/vulnerabilityAssessments/read",
        "Microsoft.Sql/servers/administrators/read",
        "Microsoft.Sql/servers/auditingSettings/read",
        "Microsoft.Sql/servers/databases/auditingSettings/read",
        "Microsoft.Sql/servers/databases/extendedAuditingSettings/read",
        "Microsoft.Sql/servers/databases/read",
        "Microsoft.Sql/servers/databases/securityAlertPolicies/read",
        "Microsoft.Sql/servers/databases/skus/read",
        "Microsoft.Sql/servers/databases/transparentDataEncryption/read",
        "Microsoft.Sql/servers/extendedAuditingSettings/read",
        "Microsoft.Sql/servers/encryptionProtector/read",
        "Microsoft.Sql/servers/firewallRules/read",
        "Microsoft.Sql/servers/read",
        "Microsoft.Sql/servers/securityAlertPolicies/read",
        "Microsoft.Sql/servers/virtualNetworkRules/read",
        "Microsoft.Sql/servers/vulnerabilityAssessments/read",
        "Microsoft.Storage/storageAccounts/blobServices/containers/read", 
        "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/read",
        "Microsoft.Storage/storageAccounts/fileServices/shares/read",
        "Microsoft.Storage/storageAccounts/listkeys/action",
        "Microsoft.Storage/storageAccounts/read",
        "Microsoft.Synapse/workspaces/read",
        "Microsoft.Web/serverfarms/read",
        "Microsoft.Web/sites/Read",
        "Microsoft.Web/sites/config/Read",
        "Microsoft.Web/sites/config/list/Action",
        "Microsoft.Web/sites/functions/read",
        "Microsoft.Web/sites/slots/Read",
        "Microsoft.Web/sites/slots/config/Read",
        "Microsoft.Web/sites/slots/config/list/Action",
        "Microsoft.Web/sites/slots/functions/read",
        "microsoft.web/sites/slots/virtualnetworkconnections/read",
        "microsoft.web/sites/virtualnetworkconnections/read"
    ],
    "NotActions": [],
    "AssignableScopes": [
        "/subscriptions/00000000-0000-0000-0000-000000000000",
        "/subscriptions/11111111-1111-1111-1111-111111111111"
    ]
}

❗️

Subscription Details

For the subscription section in the code snippets above (and below), replace the 000s and 111s with YOUR SUBSCRIPTION ID. If you are only setting this up for one subscription, you can remove the line with the 111s; you should also remove the comma in the line above it (the line with the 000s).

DivvyCloud Power User Role

{
    "Name": "DivvyCloud Power User",
    "Id": null,
    "IsCustom": true,
    "Description": "Provides full access to resources supported by DivvyCloud.",
    "Actions": [
        "Microsoft.Advisor/*",
        "Microsoft.Authorization/*",
        "Microsoft.Batch/*",
        "Microsoft.Cache/*",
        "Microsoft.Compute/*",
        "Microsoft.ContainerInstance/*",
        "Microsoft.ContainerRegistry/*",
        "Microsoft.ContainerService/*",
        "Microsoft.Databricks/*",
        "Microsoft.DataFactory/*",
        "Microsoft.DataLakeStore/*",
        "Microsoft.DBforMariaDB/*",
        "Microsoft.DBforMySQL/*",
        "Microsoft.DBforPostgreSQL/*",
        "Microsoft.DocumentDB/*",
        "Microsoft.EventHub/*",
        "Microsoft.HDInsight/*",
        "Microsoft.Insights/*",
        "Microsoft.KeyVault/*",
        "Microsoft.Logic/*",
        "Microsoft.Network/*",
        "Microsoft.OperationalInsights/*",
        "Microsoft.Resources/*",
        "Microsoft.Search/*",
        "Microsoft.Security/*",
        "Microsoft.ServiceBus/*",
        "Microsoft.Sql/*",
        "Microsoft.Storage/*",
        "Microsoft.Synapse/*",
        "Microsoft.Web/*"
    ],
    "NotActions": [],
    "AssignableScopes": [
        "/subscriptions/00000000-0000-0000-0000-000000000000",
        "/subscriptions/11111111-1111-1111-1111-111111111111"
    ]
}

DivvyCloud Reader Plus Role

DivvyCloud recommends using the 'Reader' role for read-only permissions to all resources. Note this role does not include the following additional permissions:

  • "Microsoft.Storage/storageAccounts/listkeys/action"

The above permission is used to provide visibility into blob storage containers that are configured to host static website content.

  • "Microsoft.Web/sites/config/list/Action",
  • "Microsoft.Web/sites/slots/config/list/Action"


For the permissions above, the config/list/action permission provides visibility to determine if Web Apps are configured to require authentication and for to Serverless Functions to determine if the function is enabled/disabled. The caveat is that those permissions also provide access to any environment variables configured for WebApps, which may contain sensitive information.

{
    "Name": "DivvyCloud Reader Plus",
    "Id": null,
    "IsCustom": true,
    "Description": "Provides read-only access to all Azure resources plus some additional permissions not covered by the built-in Reader role.",
    "Actions": [
        "*/read",
        "Microsoft.ContainerRegistry/registries/pull/read",
        "Microsoft.Storage/storageAccounts/listkeys/action",
        "Microsoft.Web/sites/config/list/Action",
        "Microsoft.Web/sites/slots/config/list/Action"
    ],
    "NotActions": [],
    "AssignableScopes": [
        "/subscriptions/00000000-0000-0000-0000-000000000000",
        "/subscriptions/11111111-1111-1111-1111-111111111111"
    ]
}

Creating Custom Roles

To add one of these roles to your account, copy the JSON from one of the desired roles above into a file and use either PowerShell or Azure CLI from the command line to create the role.

📘

Azure CLI (Recommended)

If you don't have the Azure CLI set up, you can install it here:
https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-yum?view=azure-cli-latest

PowerShell

New-AzureRmRoleDefinition -InputFile <role_definition>

Azure CLI

az role definition create --role-definition <role_definition>

Updating Custom Roles

To modify an existing custom role:

Retrieve the existing role with either PowerShell or Azure CLI.

PowerShell

Get-AzureRmRoleDefinition -Custom | ConvertTo-Json

Azure CLI

az role definition list --custom-role-only

Copy the JSON for the custom role you wish to modify into a new file and make the desired changes to the role definition. Then update the role in Azure.

PowerShell

Set-AzureRmRoleDefinition -InputFile <role_definition>

Azure CLI

az role definition update --role-definition <role_definition>

With these roles defined, return to Microsoft Azure to connect your Azure account with DivvyCloud.

Updated 10 days ago

Microsoft Azure - Custom Roles

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.