# Cis Azure Database 4.4

> Cis Azure Database 4.4 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure that Data Factory is using RBAC to manage privilege assignment

- Skill name: `cis-azure-database-4.4`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Database_Services_Benchmark_v2.0.0/cis-azure-database-4.4/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# 4.4 Ensure that Data Factory is using RBAC to manage privilege assignment (Manual)

## Profile Applicability

- Level 2

## Description

Role Based Access Control (RBAC) is setting permissions to the role that a user occupies. Often the user is added to a group which the account inherits permissions from. This is different than Access Policies which are used on an individual case by case basis for each user.

## Rationale

RBAC enhances security by limiting user privilege to only what is necessary for a job role, reducing the risk of unauthorized access. Additionally, RBAC aids compliance with regulations and provides clear accountability by tracking access activities linked to specific roles.

## Impact

There will be a slight increase in technical overhead in that user permissions will need to be manually assigned. However once added to a group, permissions may be edited for every account in the group at one time.

## Audit

### Audit from Azure Portal

1. From `Data Factories` select a data factory to audit.
2. In the left column select `Access control (IAM)`.
3. To check an individual account or group, in the horizontal row, select `Check access`, then search for a user, group, or managed identity.
4. To check all roles, in the horizontal row select `Role assignments`, and scroll through all the roles that have permission to this data factory.

## Expected Result

Appropriate RBAC role assignments should be configured for the Data Factory, with roles scoped to the minimum necessary permissions for each user or group.

## Remediation

### Remediate from Azure Portal

1. From `Data Factories` select a data factory to audit.
2. In the left column select `Access control (IAM)`.
3. Select `+ Add \/` and then `Add role assignment`.
4. Select the builtin or custom role to be added. Then select `Next`.
5. Next to `Assign access to` select either `User, group, or service principal` or `Managed identity` to be added to this role.
6. Choose `Select members`, then search for the resource that is to be added to this role.
7. Enter a description if desired.
8. Select `Next`, review your choices, then `Review + assign`.

## Default Value

By default, Data factories use RBAC but only with permissions for owners to make changes.

## References

1. https://learn.microsoft.com/en-us/azure/data-factory/concepts-roles-permissions

---

Source: https://www.openparable.com/skill/devops-security/cis-azure-database-4-4 (OpenParable). Cite the canonical URL above.