Skip to content

fix(azure): use valid scoped RBAC inventory - #309

Merged
ruby-dlee merged 1 commit into
mainfrom
codex/azure-role-assignment-scope-list
Aug 22, 2026
Merged

fix(azure): use valid scoped RBAC inventory#309
ruby-dlee merged 1 commit into
mainfrom
codex/azure-role-assignment-scope-list

Conversation

@ruby-dlee

Copy link
Copy Markdown
Owner

Summary

  • remove the invalid Azure CLI --scope plus --all combination from cleanup and retained purge
  • keep least-privilege direct-scope reads and a local exact-scope identity fence
  • execute cross-scope adversaries and pin the exact CLI argument sequence

Live failure

The first exact retained purge refused before mutation because Azure CLI rejects role assignment list --scope ... --all. The retained cell stayed unchanged.

Validation

  • tests/run.sh tests/fm-azure-validation.test.sh
  • bin/fm-lint.sh (252 scripts)
  • Python compile, shell syntax, and diff checks
  • independent safety review: clear

@ruby-dlee
ruby-dlee merged commit d420269 into main Aug 22, 2026
13 checks passed
@ruby-dlee
ruby-dlee deleted the codex/azure-role-assignment-scope-list branch August 22, 2026 16:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant