iann0036/iam-dataset

Azure: permissions with duplicate names

cnotin opened this issue · 3 comments

cnotin commented

First of all, thanks for your work!

I noticed that some Azure permissions had duplicate names. For example with Microsoft.AAD/register/action:
image

There are a couple other examples:

  • Microsoft.AlertsManagement/register/action
  • Microsoft.AzureStack/register/action
  • Microsoft.CognitiveServices/register/action
  • Microsoft.Migrate/register/action
  • Microsoft.OffAzure/register/action
  • Microsoft.PowerBIDedicated/register/action

Or even worse in other cases, for example with Microsoft.AzureSphere/catalogs/read:
image

Do you know if it's Microsoft's fault, or an artifact of the retrieval method?

iann0036 commented

Hi @cnotin,

Thanks for raising this, it's an interesting issue.

These files are generated directly from the Azure CLI, so it's on Microsoft's side. It may be intentional to describe that two practical actions have the same underlying permissions?

Will have a think on the best way to approach this.

cnotin commented

Thanks Iann.
Yeah perhaps there are different actions which share the same permission, even though it's surprising 🤷‍♂️

iann0036 commented

Hey @cnotin,

Getting back to this, I've decided to aggregate duplicates in the provided set. This'll take effect overnight.

  • 👍1