调用Defender for Cloud API所需角色及ASCMonitor角色权限咨询

PUT https://management.azure.com/subscriptions/a5caac9c-5c04-49af-b3d0-e204f40345d5/resourceGroups/exampleResourceGroup/providers/Microsoft.Security/securityConnectors/exampleSecurityConnectorName?api-version=2024-03-01-preview

{
  "location": "Central US",
  "etag": "etag value (must be supplied for update)",
  "tags": {},
  "properties": {
    "hierarchyIdentifier": "exampleHierarchyId",
    "environmentName": "AWS",
    "environmentData": {
      "environmentType": "AwsAccount",
      "scanInterval": 4
    },
    "offerings": [
      {
        "offeringType": "CspmMonitorAws",
        "nativeCloudConnection": {
          "cloudRoleArn": "arn:aws:iam::00000000:role/ASCMonitor"
        }
      }
    ]
  }
}

1. 调用Defender for Cloud API所需角色 #

• Security Admin角色：具备管理Defender for Cloud所有安全资源的权限，包含安全连接器的创建与更新操作。
• Contributor角色：可管理订阅内所有类型的Azure资源，自然覆盖安全连接器的配置权限。
• 自定义最小权限角色：若需精细化权限控制，可创建仅包含Microsoft.Security/securityConnectors/write权限的自定义角色，满足API调用的核心需求。

2. ASCMonitor角色的来源与所需权限 #

来源 #

ASCMonitor是在目标AWS账户中手动创建的IAM角色，用于授予Azure Defender for Cloud访问AWS资源的权限，实现云安全态势管理（CSPM）的监控能力。创建时需配置信任关系，允许Azure Defender for Cloud的AWS账户主体假定该角色。

所需权限 #

该角色需具备以下基础权限（以AWS IAM策略格式呈现），覆盖Defender for Cloud安全扫描、配置审计、威胁检测的核心需求：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:GetAccountPasswordPolicy",
        "iam:GetAccountSummary",
        "iam:GetRole",
        "iam:GetUser",
        "iam:ListAccountAliases",
        "iam:ListAttachedRolePolicies",
        "iam:ListRoles",
        "iam:ListUsers",
        "ec2:DescribeRegions",
        "ec2:DescribeInstances",
        "ec2:DescribeSecurityGroups",
        "s3:GetBucketAcl",
        "s3:GetBucketPolicy",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrailStatus",
        "config:DescribeConfigurationRecorders",
        "config:DescribeConfigurationRecorderStatus",
        "config:GetResourceConfigHistory",
        "config:ListDiscoveredResources",
        "guardduty:GetDetector",
        "guardduty:GetFindings",
        "guardduty:ListDetectors"
      ],
      "Resource": "*"
    }
  ]
}

• 实际配置可根据启用的Defender具体功能调整权限范围，上述为CSPM监控场景的必要基础权限。

内容的提问来源于stack exchange，提问作者TheWalkingMalteser