ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-30 15:24:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(azure): stabilize deployment role assignments

Browse Source
This commit is contained in:
Hugo P.Brito committed 2026-08-21 11:56:04 +01:00
1 parent 0698987007
commit 5f64b34d08
9 files changed
+41 -29
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/assets/templates/azure/prowler-scan.json
+5 -5
View File
@@ -5,7 +5,7 @@
"_generator": {
"name": "bicep",
"version": "0.46.1.21595",
"templateHash": "4092263301802395344"
"templateHash": "16146816613430830317"
}
},
"parameters": {
@@ -19,7 +19,7 @@
"type": "string",
"defaultValue": "Prowler",
"metadata": {
"description": "Cosmetic label used inside the role assignment names so multiple deployments do not collide. Free text; keep the default unless you need to distinguish multiple Prowler deployments."
"description": "Cosmetic label included in the custom role description. Free text; keep the default unless you need to distinguish multiple Prowler deployments."
}
},
"customRoleName": {
@@ -41,7 +41,7 @@
"name": "[variables('customRoleDefinitionName')]",
"properties": {
"roleName": "[parameters('customRoleName')]",
"description": "Role used by Prowler for checks that require Azure actions beyond the built-in Reader role.",
"description": "[format('Role used by {0} for Prowler checks that require Azure actions beyond the built-in Reader role.', parameters('deploymentLabel'))]",
"type": "CustomRole",
"assignableScopes": [
"[subscription().id]"
@@ -62,7 +62,7 @@
{
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2022-04-01",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), parameters('deploymentLabel'), 'Reader')]",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), variables('readerRoleDefinitionId'))]",
"properties": {
"principalId": "[parameters('servicePrincipalObjectId')]",
"principalType": "ServicePrincipal",
@@ -72,7 +72,7 @@
{
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2022-04-01",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), parameters('deploymentLabel'), parameters('customRoleName'))]",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('customRoleDefinitionName')))]",
"properties": {
"principalId": "[parameters('servicePrincipalObjectId')]",
"principalType": "ServicePrincipal",
docs/snippets/azure-prowler-scan-template.mdx
+5 -5
View File
@@ -8,7 +8,7 @@
"_generator": {
"name": "bicep",
"version": "0.46.1.21595",
"templateHash": "4092263301802395344"
"templateHash": "16146816613430830317"
}
},
"parameters": {
@@ -22,7 +22,7 @@
"type": "string",
"defaultValue": "Prowler",
"metadata": {
"description": "Cosmetic label used inside the role assignment names so multiple deployments do not collide. Free text; keep the default unless you need to distinguish multiple Prowler deployments."
"description": "Cosmetic label included in the custom role description. Free text; keep the default unless you need to distinguish multiple Prowler deployments."
}
},
"customRoleName": {
@@ -44,7 +44,7 @@
"name": "[variables('customRoleDefinitionName')]",
"properties": {
"roleName": "[parameters('customRoleName')]",
"description": "Role used by Prowler for checks that require Azure actions beyond the built-in Reader role.",
"description": "[format('Role used by {0} for Prowler checks that require Azure actions beyond the built-in Reader role.', parameters('deploymentLabel'))]",
"type": "CustomRole",
"assignableScopes": [
"[subscription().id]"
@@ -65,7 +65,7 @@
{
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2022-04-01",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), parameters('deploymentLabel'), 'Reader')]",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), variables('readerRoleDefinitionId'))]",
"properties": {
"principalId": "[parameters('servicePrincipalObjectId')]",
"principalType": "ServicePrincipal",
@@ -75,7 +75,7 @@
{
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2022-04-01",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), parameters('deploymentLabel'), parameters('customRoleName'))]",
"name": "[guid(subscription().id, parameters('servicePrincipalObjectId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('customRoleDefinitionName')))]",
"properties": {
"principalId": "[parameters('servicePrincipalObjectId')]",
"principalType": "ServicePrincipal",
docs/user-guide/providers/azure/authentication.mdx
+3 -3
View File
@@ -267,7 +267,7 @@ $cert = New-SelfSignedCertificate -Subject "CN=Prowler" `
Export-Certificate -Cert $cert -FilePath prowler.cer
# Export a PKCS#12 bundle for Prowler. Keep this value secret.
# Export an unencrypted PKCS#12/PFX bundle for Prowler. Keep this value secret.
$pfxBytes = $cert.Export('Pfx', '')
[Convert]::ToBase64String($pfxBytes)
```
@@ -311,7 +311,7 @@ Paste the following into the Certificate Authentication form of the Azure add-pr
- **Tenant ID** — copy the Directory (tenant) ID from the App Registration overview.
- **Client ID** — copy the Application (client) ID from the App Registration overview.
- **Certificate Content** — provide the base64-encoded **PEM bundle** (certificate + private key) or PKCS#12 export. Prowler needs both parts to sign the token request.
- **Certificate Content** — provide the base64-encoded **PEM bundle** (certificate + private key) or an unencrypted PKCS#12/PFX export. Prowler needs both parts to sign the token request and does not accept password-protected PKCS#12/PFX input.
### Prowler CLI
@@ -325,7 +325,7 @@ export AZURE_CERTIFICATE_CONTENT="<base64-encoded certificate and private key bu
prowler azure --certificate-auth
```
Alternatively, provide a PEM or PKCS#12 file that contains both the certificate and matching private key:
Alternatively, provide a PEM file or an unencrypted PKCS#12/PFX file that contains both the certificate and matching private key. Password-protected PKCS#12/PFX input is not supported:
```console
prowler azure --certificate-auth --certificate-path /path/to/prowler-bundle.pem