117 lines
3.3 KiB
PowerShell
117 lines
3.3 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory=$true)]
|
|
[string]$InputFile
|
|
)
|
|
|
|
# Ensure you're logged into Azure CLI
|
|
try {
|
|
$null = az account show
|
|
}
|
|
catch {
|
|
Write-Host "Please log in to Azure CLI first using 'az login'"
|
|
exit
|
|
}
|
|
|
|
# Function to get all role definitions
|
|
function Get-AllRoleDefinitions {
|
|
$roles = az role definition list |
|
|
ConvertFrom-Json |
|
|
ForEach-Object { $_ } |
|
|
# Where-Object { $_.roleName -eq "Website Contributor" }
|
|
Where-Object { $_.roleType -ne "CustomRole" -and $_.roleName -ne "Contributor" -and $_.roleName -ne "Owner" }
|
|
return $roles
|
|
}
|
|
|
|
# Function to check if a string matches a resource type pattern
|
|
function Test-ResourceTypeMatch {
|
|
param (
|
|
[string]$Pattern,
|
|
[string]$ResourceType
|
|
)
|
|
$patternParts = $Pattern -split '/'
|
|
$resourceTypeParts = $ResourceType -split '/'
|
|
|
|
for ($i = 0; $i -lt $patternParts.Count; $i++) {
|
|
if ($i -ge $resourceTypeParts.Count -and $patternParts[$i] -ne "*") {
|
|
return $false
|
|
}
|
|
|
|
if ($patternParts[$i] -eq '*') {
|
|
if ($i -eq $patternParts.Count - 1) {
|
|
return $true
|
|
}
|
|
continue
|
|
}
|
|
|
|
if ($patternParts[$i] -ne $resourceTypeParts[$i]) {
|
|
return $false
|
|
}
|
|
}
|
|
|
|
# If the pattern is shorter than the resource type, it's only a match if the last part was a wildcard
|
|
return ($patternParts.Count -eq $resourceTypeParts.Count) -or ($patternParts[-1] -eq '*')
|
|
}
|
|
|
|
# Function to check if a role grants access to a resource type
|
|
function Test-RoleAccess {
|
|
param (
|
|
$Role,
|
|
$ResourceType
|
|
)
|
|
$hasAccess = $false
|
|
foreach ($permission in $Role.permissions) {
|
|
# Check actions and dataActions
|
|
foreach ($action in ($permission.actions + $permission.dataActions)) {
|
|
if (Test-ResourceTypeMatch -Pattern $action -ResourceType $ResourceType) {
|
|
$hasAccess = $true
|
|
break
|
|
}
|
|
}
|
|
|
|
# Check notActions and notDataActions
|
|
foreach ($notAction in ($permission.notActions + $permission.notDataActions)) {
|
|
if (Test-ResourceTypeMatch -Pattern $notAction -ResourceType $ResourceType) {
|
|
return $false # Explicitly not allowed
|
|
}
|
|
}
|
|
|
|
if ($hasAccess) {
|
|
break
|
|
}
|
|
}
|
|
return $hasAccess
|
|
}
|
|
|
|
# Get all role definitions
|
|
$allRoles = Get-AllRoleDefinitions
|
|
|
|
# Read the file with resource types
|
|
try {
|
|
$resourceTypes = Get-Content -Path $InputFile -ErrorAction Stop
|
|
$resourceTypes = $resourceTypes | Sort-Object
|
|
}
|
|
catch {
|
|
Write-Host "Error reading input file: $_"
|
|
exit
|
|
}
|
|
|
|
# Process each resource type
|
|
foreach ($resourceType in $resourceTypes) {
|
|
Write-Host "Resource Type: $resourceType"
|
|
$matchingRoles = @()
|
|
|
|
foreach ($role in $allRoles) {
|
|
if (Test-RoleAccess -Role $role -ResourceType $resourceType) {
|
|
$matchingRoles += $role.roleName
|
|
}
|
|
}
|
|
|
|
if ($matchingRoles.Count -gt 0) {
|
|
Write-Host "Roles granting access:"
|
|
$matchingRoles | ForEach-Object { Write-Host " - $_" }
|
|
} else {
|
|
Write-Host "No roles found granting access to this resource type."
|
|
}
|
|
Write-Host ""
|
|
} |