Description

Detects when an Azure subscription lacks proper Resource Lock management permissions. Resource Locks are a critical security control that prevent accidental or malicious deletion/modification of resources, and missing lock management permissions could leave resources vulnerable to unauthorized changes.

Detection Strategy

• Checks if any roles in the subscription have permissions for lock management operations (read/write/delete)

• Verifies if there are role assignments that grant lock management permissions to users/groups

• Reports a vulnerability if any of the crucial lock management permissions (read, write, or delete) are missing from role assignments

• Each missing permission (Microsoft.Authorization/locks/read, write, or delete) is reported separately