Control: Azure > CIS v1.2 > 1 - Identity and Access Management > 1.21 - Ensure that no custom subscription owner roles are created (Scored)

Configures auditing against a CIS Benchmark item.

Level: 2 (Scored)

Subscription ownership should not include permission to create custom owner roles. The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.

Resource Types

This control targets the following resource types:

Azure > IAM > Role Definition

Primary Policies

The following policies can be used to configure this control:

1.21 - Ensure that no custom subscription owner roles are created (Scored)

In Your Workspace

Developers

Control Type URI

tmod:@turbot/azure-cisv1-2#/control/types/r0121

Category URI

tmod:@turbot/cis#/control/categories/v0704

GraphQL

query controlType(id: "tmod:@turbot/azure-cisv1-2#/control/types/r0121") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/azure-cisv1-2#/control/types/r0121'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv1-2#/control/types/r0121"