Phase 1 - Cloud IAM Environment Reconstruction Cloud provider: Azure Environment boundaries: Staging subscription Production subscription Production resource group: rg-payments-prod Confirmed configuration payments-api-mi is a user-assigned managed identity. It has Contributor access to the production resource group. It has Key Vault Secrets User access. release-pipeline-sp has Owner access at production subscription scope. platform-ops-group has User Access Administrator. Inferred relationships The payment API likely uses payments-api-mi to interact with production resources. The release pipeline likely uses release-pipeline-sp for deployment activities. These relationships require validation because application and pipeline configuration was not provided. Missing evidence Azure role-assignment conditions Azure Policy restrictions PIM configuration Conditional Access controls Key Vault RBAC/resource configuration Exact resource-level permissions Management-group policies --- Phase 2 - Identity & Privilege Inventory Identity Type Owner Environment Assigned Role Privilege Level Sensitive Access Risk payments-api-mi Managed Identity Unknown Production Contributor Privileged Key Vault 🔴 High release-pipeline-sp Service Principal DevOps Production Owner Administrative Production subscription 🔴 Critical platform-ops-group Group Platform Ops Production User Access Administrator Highly Privileged IAM 🔴 Critical Key observation The supplied configuration contains multiple identities capable of making significant production changes. The exact effective privileges still require validation against Azure Policy, PIM, resource scopes, and additional role assignments. --- Phase 3 - Effective Permission Analysis payments-api-mi Directly supplied: Contributor → rg-payments-prod Additional access: Key Vault Secrets User Therefore, the supplied evidence establishes both: Broad resource-management capability within the production resource group Secret-reading capability in Key Vault The exact effective access to SQL, Storage, App Service, and other resources depends on which resources are contained within the resource group and any applicable restrictions. Classification: 🟠 Strong Risk Indicator --- release-pipeline-sp Supplied: Owner → Production subscription Owner is a highly privileged Azure role. This creates a broad administrative boundary covering the production subscription. Classification: 🔴 Confirmed High-Privilege Assignment This does not by itself establish that misuse or privilege escalation has occurred. --- platform-ops-group Supplied: User Access Administrator This role is highly sensitive because it concerns Azure access management. The exact effective impact depends on scope and applicable restrictions. Classification: 🔴 High-Privilege Identity --- Phase 4 - Excessive & Overly Broad Permission Audit Finding AZ-IAM-001 Identity: payments-api-mi Permission: Contributor Scope: Production resource group Why this is broad A workload identity generally needs only the resource operations required by its application. Contributor at resource-group scope potentially gives substantially broader resource-management capability than an application may require. Usage evidence The identity is active daily, but permission-level usage data is unavailable. Therefore: Do not classify Contributor as unused. Recommendation Determine the API's actual operations and replace broad Contributor access with a dedicated custom role or narrower built-in role assignments. Severity: High --- Finding AZ-IAM-002 Identity: release-pipeline-sp Permission: Owner Scope: Production subscription Risk Subscription-level Owner is substantially broader than a typical application deployment requirement. The pipeline may only require deployment operations against specific resource types. Recommendation Evaluate deployment operations and replace Owner with a deployment-specific role structure. Severity: Critical --- Finding AZ-IAM-003 Identity: platform-ops-group Permission: User Access Administrator Risk IAM administration is security-sensitive because access-management authority can affect other identities. Recommendation Use narrowly scoped and, where operationally suitable, temporary privileged access. Severity: High --- Phase 5 - Unused Permission Analysis Available evidence is insufficient to identify individual unused permissions. Identity Permission Evidence Assessment Recommendation payments-api-mi Contributor capabilities Daily identity activity Individual permissions unknown Validate payments-api-mi Key Vault Secrets User Daily secret access observed Appears actively required Retain with scope review release-pipeline-sp Owner capabilities Pipeline active several times weekly Individual permissions unknown Restrict after dependency analysis platform-ops-group User Access Administrator No usage data Unknown Validate Important distinction Daily identity activity does not prove that every permission within a broad role is necessary. The next step should be permission-level activity analysis. --- Phase 6 - Role & Trust Relationship Analysis The supplied relationships are: payments-api-mi → Contributor → production resource group payments-api-mi → Key Vault Secrets User → Key Vault release-pipeline-sp → Owner → production subscription platform-ops-group → User Access Administrator Risk relationship The most important relationship is: release-pipeline-sp → Owner → Production Subscription This provides the pipeline identity with subscription-wide administrative authority. Required validation Review: Service principal ownership Authentication method PIM Credential lifecycle Deployment permissions Scope restrictions Approval controls Pipeline authorization model Classification: 🔴 Confirmed Excessive-Privilege Indicator --- Phase 7 - Privilege Escalation Path Analysis Path AZ-001 Source payments-api-mi ↓ Contributor ↓ Production resource group ↓ Potential capability Modification of multiple production resources Assessment 🟠 Strong Risk Indicator The identity has broader production-management authority than a narrowly scoped workload identity would normally require. However, the supplied configuration does not prove a specific escalation mechanism. --- Path AZ-002 Source release-pipeline-sp ↓ Owner ↓ Production subscription ↓ Administrative capability Subscription-wide resource and access-management authority Assessment 🔴 Confirmed High-Privilege Path This is a confirmed administrative permission relationship based on the supplied role assignment. Whether it creates an actual privilege-escalation scenario depends on how the pipeline identity is protected and used. --- Phase 8 - Dangerous Permission Combination Analysis Combination AZ-C01 Contributor + Key Vault Secrets User Affected identity: payments-api-mi Why this matters The same workload identity has: Broad production resource-management capability Sensitive secret access The combination increases the consequences of compromise or misuse of the workload identity. Mitigation Separate responsibilities where practical: Application identity → only required application operations Secret access → only required secrets Resource administration → dedicated operational identity Priority: P1 --- Combination AZ-C02 Owner + production deployment capability Affected identity: release-pipeline-sp Why risky A pipeline identity requires strong protection because its permissions can affect production. Subscription-wide Owner is broader than many deployment workflows require. Mitigation Create a deployment-specific permission model. Priority: P1 --- Combination AZ-C03 User Access Administrator + production scope Affected identity: platform-ops-group Risk IAM-management authority can affect the access available to other identities. Mitigation Restrict scope and use privileged-access controls where available. Priority: P1 --- Phase 9 - Cross-Service & Cross-Boundary Access Analysis Relationship 1 Managed Identity → App Service → Production resources payments-api-mi operates within the production resource group. Risk: Broad application identity permissions. --- Relationship 2 Managed Identity → Key Vault → Application secrets The payment API can access Key Vault secrets. Risk: Sensitive credential exposure if the workload identity is compromised. --- Relationship 3 Service Principal → CI/CD → Production subscription The deployment identity has subscription-level Owner access. Risk: CI/CD becomes a high-value administrative trust boundary. --- Relationship 4 Operations Group → Azure IAM platform-ops-group has User Access Administrator. Risk: Identity-management boundary is highly privileged. --- Phase 10 - High-Value Resource & Blast-Radius Analysis Resource Accessible Identity Access Sensitivity Blast Radius Production App Service payments-api-mi Contributor-level resource management High Resource group Key Vault payments-api-mi Secret access Very High Secrets in assigned scope Production SQL Potentially payments-api-mi Depends on resource configuration Very High Database Production Storage Potentially payments-api-mi Depends on actual resource permissions High Storage resources Production subscription release-pipeline-sp Owner Critical Subscription Azure IAM platform-ops-group User Access Administrator Critical Assigned scope Main blast-radius concern The pipeline service principal has the broadest explicitly documented administrative scope. --- Phase 11 - Control & Compensating-Control Analysis No evidence was supplied for: Privileged Identity Management Just-in-time activation Approval requirements Azure Policy Management-group restrictions Conditional Access Workload identity restrictions Resource locks Explicit deny-like policy controls Pipeline approval gates Therefore, these controls cannot be credited as mitigating controls yet. Evidence status ⚪ Requires Validation Absence of supplied evidence does not prove the controls are absent. --- Phase 12 - Risk Scoring & Business Impact Finding Technical Severity Potential Business Impact Main Reason AZ-IAM-001 High High Broad workload resource-management access AZ-IAM-002 Critical Critical Subscription-level Owner for CI/CD identity AZ-IAM-003 High High IAM administration authority AZ-C01 High High Resource management combined with secret access AZ-C02 Critical Critical Administrative CI/CD boundary Business impact areas Potential impact includes: Confidentiality: Exposure of application secrets or production data Integrity: Unauthorized modification of production resources Availability: Incorrect production resource changes could disrupt services Operations: Excessive pipeline privileges increase operational blast radius Compliance: Sensitive data and privileged-access controls may require additional governance These are potential impacts based on the configuration, not evidence that an incident has occurred. --- Phase 13 - Least-Privilege Remediation Design AZ-IAM-001 - Replace Contributor for workload identity Current access: payments-api-mi → Contributor → production resource group Required access: Only the operations the payment API actually performs. Recommended restriction: Create a dedicated application role containing only required actions and resource scopes. Expected risk reduction: Reduces the number of production resources the application identity can modify. Dependency: Application dependency mapping. Verification: Test normal payment API operations and verify unrelated resource-management operations are denied. --- AZ-IAM-002 - Reduce CI/CD Owner privilege Current access: release-pipeline-sp → Owner → production subscription Required access: Only the resource-management operations required by the deployment pipeline. Recommended restriction: Replace subscription-wide Owner with narrowly scoped deployment permissions. Potential structure: Pipeline identity → deployment role → specific production resources rather than: Pipeline identity → Owner → entire subscription Expected risk reduction: Significantly reduces the administrative blast radius of the CI/CD identity. Dependency: Complete inventory of pipeline deployment operations. Verification: Run a normal production deployment and verify unrelated subscription/resource-management operations are denied. --- AZ-IAM-003 - Restrict User Access Administrator Current access: platform-ops-group → User Access Administrator Required access: Only the IAM scopes and administrative operations genuinely required by the operations team. Recommended restriction: Review scope, membership, activation process, and privileged-access controls. Expected risk reduction: Reduces the number of identities capable of changing access relationships. Verification: Validate approved IAM administration while confirming unauthorized access-management operations are blocked.