Azure RBAC Least-Privilege Analyzer

Stop over-permissioning your Azure role assignments.
Scans Bicep & ARM templates, flags broad roles, suggests least-privilege alternatives, and generates remediation patches.

The Problem

73% of Azure subscriptions have over-permissioned role assignments (Microsoft's own data). Developers routinely assign Contributor or Owner when they need only a handful of specific actions. There is no built-in tooling that maps actual resource operations to minimum roles — until now.

What This Extension Does

Installation

From VSIX

# Build the extension
npm install
npm run compile
npx @vscode/vsce package

# Install
code --install-extension azure-rbac-least-privilege-analyzer-1.0.0.vsix

Quick Start

1. Open a Bicep or ARM Template File

Open any .bicep or ARM template .json file that contains role assignments. The extension activates automatically.

2. See Diagnostics

Over-permissioned role assignments are immediately flagged with yellow squiggly underlines. Hover over the underline to see the full recommendation:

⚠ Over-permissioned: "Contributor" assigned but a more restrictive role is available.
  Suggestion: use "Storage Blob Data Contributor" instead.
  Role "Contributor" grants 3 action patterns but only 2 are used.

3. Apply Quick Fixes

Click the lightbulb (💡) or press Ctrl+. on a flagged assignment to see available fixes:

• Replace with "Storage Blob Data Contributor" (least-privilege) — rewrites the role GUID in place
• Generate remediation patch file — opens a new Bicep file with all fixes

4. Use Commands

Open the Command Palette (Ctrl+Shift+P) and type "Azure RBAC":

Detailed Example

Before (over-permissioned)

// ⚠ Contributor grants full control-plane access to ALL resource types
// but this deployment only uses Storage and Key Vault
resource contributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, 'b24988ac-6180-42a0-ab88-20f7382dd24c', principalId)
  properties: {
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions',
      'b24988ac-6180-42a0-ab88-20f7382dd24c'  // ← Contributor
    )
    principalId: principalId
    principalType: 'ServicePrincipal'
  }
}

Analyzer output:

⚠ Over-permissioned: "Contributor" assigned but a more restrictive role is 
available. Suggestion: use "Storage Blob Data Contributor" instead.

After (least-privilege)

// ✅ Storage Blob Data Contributor — only grants blob read/write/delete
resource storageBlobContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, 'ba92f5b4-2d11-453d-a403-e96b0029c9fe', principalId)
  properties: {
    roleDefinitionId: subscriptionResourceId(
      'Microsoft.Authorization/roleDefinitions',
      'ba92f5b4-2d11-453d-a403-e96b0029c9fe'  // ← Storage Blob Data Contributor
    )
    principalId: principalId
    principalType: 'ServicePrincipal'
    description: 'Least-privilege: Storage Blob Data Contributor'
  }
}

Live Activity Log Analysis

For the most precise recommendations, the extension can connect to your Azure subscription and compare assigned permissions against actually-used operations from the Activity Log.

Prerequisites

1. Azure CLI installed and authenticated (az login)
2. Read access to the Activity Log (Monitoring Reader role or similar)
3. Configure your subscription in settings or enter it when prompted

How to Use

1. Run "Azure RBAC: Analyze Live Subscription Activity Log" from the Command Palette
2. Enter your Subscription ID (or configure it in settings)
3. The extension queries the last 90 days (configurable) of Activity Log data
4. A Markdown report opens with per-principal findings:

## Principal: my-service-principal

- Assigned roles: Contributor
- Operations exercised: 12

### Contributor → Storage Blob Data Reader
- **Severity:** high
- **Reason:** Principal exercised 12 operations in the last 90 days.
  Current role "Contributor" can be replaced with "Storage Blob Data Reader".

Custom Role Analysis

The analyzer detects custom role definitions (Microsoft.Authorization/roleDefinitions) and compares their actions and dataActions against what is actually needed:

ℹ Custom role "Custom Storage Manager" has 4 unused permission(s) out of 10 total.
  Remove unused permissions to enforce least-privilege.

Quick Fix: "Remove unused permissions from custom role" — automatically strips the unnecessary entries.

Extension Settings

Configure via File > Preferences > Settings or .vscode/settings.json:

Example settings.json

{
  "azureRbac.severityLevel": "Error",
  "azureRbac.flaggedRoles": [
    "Owner",
    "Contributor",
    "User Access Administrator",
    "Key Vault Administrator"
  ],
  "azureRbac.subscriptionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "azureRbac.activityLogDays": 60,
  "azureRbac.autoAnalyzeOnSave": true
}

Sidebar Views

The extension adds an Azure RBAC Analyzer panel to the Activity Bar (shield icon) with two tree views:

Role Assignments

Shows all detected role assignments grouped by file. Each entry shows:

• ⚠ Over-permissioned assignments (with severity indicator)
• ✓ Properly-scoped assignments
• Expandable details with recommendations

Recommendations

A flat list of all suggested changes across the workspace:

• Role replacements (Contributor → Storage Blob Data Reader)
• Custom role trim suggestions
• Click any item to navigate to the source location

Built-in Roles Database

The extension ships with metadata for 30+ commonly used Azure built-in roles across these categories:

Browse any role's full permission set via "Azure RBAC: Show Role Details".

Supported File Types

Architecture

src/
├── extension.ts               # VS Code activation, commands, wiring
├── analyzers/
│   ├── bicepAnalyzer.ts       # Parse Bicep files for role assignments
│   ├── armAnalyzer.ts         # Parse ARM JSON templates
│   └── activityLogAnalyzer.ts # Azure Activity Log integration
├── roles/
│   ├── builtInRoles.ts        # Built-in role database (30+ roles)
│   └── roleMapper.ts          # Action-to-role mapping engine
├── remediation/
│   └── patchGenerator.ts      # Bicep remediation patch output
└── providers/
    ├── diagnosticsProvider.ts  # Real-time editor diagnostics
    ├── codeActionProvider.ts   # Quick Fix code actions
    └── treeViewProvider.ts     # Sidebar tree views

Development

Prerequisites

• Node.js 18+
• VS Code 1.85+

Setup

cd azure-rbac-least-privilege-analyzer
npm install

Build

npm run compile

Watch Mode

npm run watch

Run Extension (Debug)

1. Open the project in VS Code
2. Press F5 to launch the Extension Development Host
3. Open a .bicep file to see the analyzer in action

Package for Distribution

npx @vscode/vsce package

This produces a .vsix file you can install or publish to the Marketplace.

Publish to Marketplace

npx @vscode/vsce publish

You'll need a Personal Access Token from Azure DevOps.

Example Files

The examples/ directory contains sample files for testing:

FAQ

Does this extension make changes to my Azure subscription?

No. The extension only reads and analyzes files locally. The Activity Log feature reads data from Azure but never modifies your subscription. Remediation patches are generated as new Bicep files for you to review and deploy manually.

Does it work with Terraform?

Not yet. Currently supports Bicep and ARM templates. Terraform support is planned for a future release.

How does it know what permissions I actually need?

Two approaches:

1. Static analysis: Infers required actions from other Azure resources in the same template (e.g., a Storage Account implies storage-related actions).
2. Activity Log analysis: Queries actual operations from your Azure Activity Log to see what was really used.

Can I add custom roles to the database?

The built-in database ships with the extension. To extend it, you can modify src/roles/builtInRoles.ts and rebuild. A future release will support loading custom role definitions from settings.

Why doesn't it detect all 400+ built-in roles?

The extension ships with the most commonly over-permissioned roles. The role database is extensible and will grow with community contributions. For Activity Log analysis, it queries live role definitions from your subscription.

Contributing

Contributions welcome! Areas where help is appreciated:

• Adding more built-in roles to the database
• Terraform HCL support
• Improved Bicep parsing (currently regex-based; could use Bicep language service)
• UI improvements for the tree view sidebar
• Additional resource-to-action mappings

License

MIT