Appearance
SecOps Least Privilege Report
Audit date: April 15, 2026 Scope: SecOps platform — all identities, permissions, and database access Stories: LPRIV-001 through LPRIV-006
See Detailed Audit for per-story evidence tables.
Identities in Scope
| Identity | Type | Used By |
|---|---|---|
id-secops-prod | User-assigned managed identity | ca-secops-prod web app Container App |
id-agents-prod | User-assigned managed identity | Container App Jobs (orchestrator, AWS, DDE agents) |
cirius-findings-tracker | App registration | SSO (MSAL PKCE) and RBAC group lookups |
Cirius SecOps Bot | App registration | Teams bot — user resolution |
secopsadmin | PostgreSQL login role | ca-secops-prod → psql-secops-prod |
Current State
id-secops-prod — Web App Managed Identity
| Role | Scope | Required For |
|---|---|---|
AcrPull | ciriusagentsprod (resource) | Container image pull |
Key Vault Secrets User | cirius-openai-kv-prod (resource) | Runtime secrets (API keys, DB URL) |
Status: Minimal. No Contributor, Owner, or subscription-level roles.
id-agents-prod — Agents Managed Identity
| Role | Scope | Required For |
|---|---|---|
Key Vault Secrets User | cirius-openai-kv-prod (resource) | Agent runtime secrets |
Log Analytics Reader | cirius-logging-law-central (resource) | KQL queries for all 17+ agents |
AcrPull | ciriusagentsprod (resource) | Container image pull |
Storage Table Data Contributor | ciriussecuritymemprod (resource) | IOC memory (SecurityMemory table) |
Storage Blob Data Contributor | ciriusarchiveprod (resource) | Evidence archive uploads |
Cognitive Services OpenAI User | cirius-openai-prod (resource) | SecurityAgent LLM triage |
Reader | Logging subscription | Azure resource discovery |
Security Reader | Logging subscription | Defender for Cloud findings |
Note: Reader and Security Reader at subscription scope are broader than ideal. All other roles are resource-scoped. See Proposed State for subscription-level scope investigation.
cirius-findings-tracker — Web App Registration
| Permission | Type | Required For |
|---|---|---|
User.Read | Delegated | MSAL PKCE sign-in |
GroupMember.Read.All | Application | RBAC group membership check (SecOps group ffdf1dcb) |
User.Read.All | Application | Entra UPN resolution for rule attribution |
Status: Minimal — 3 permissions, all with documented owners.
Cirius SecOps Bot — Bot Registration
| Permission | Type | Required For |
|---|---|---|
User.Read.All | Application | Teams aadObjectId → UPN resolution |
Status: Minimal — 1 permission.
PostgreSQL — Database Access
| Account | Type | Current Permissions |
|---|---|---|
secopsadmin | Administrator | Full superuser — ALL privileges on ALL objects |
Status: ❌ Over-privileged — application connects as DB admin.
Proposed Tightened State
Priority 1 — PostgreSQL Service Account (LPRIV-003)
Create scoped secops_app role:
CONNECTtosecopsdatabaseUSAGE, CREATEonpublicschema (CREATE needed for Alembic migrations)SELECT, INSERT, UPDATE, DELETEon all application tablesUSAGE, SELECTon all sequences
Risk if not fixed: DB admin compromise gives full data access and ability to drop tables. Effort: Low — SQL script ready in lpriv-secops-audit.md. Rory approval required: Yes — production DB change.
Priority 2 — Investigate Subscription-Level Reader Roles (id-agents-prod)
Reader and Security Reader at subscription scope give read access to all resources in the logging subscription. Investigate whether these can be narrowed to specific resource groups (rg-logging-logs, rg-logging-archive) without breaking agent functionality.
Risk: Lower than Priority 1 — read-only roles don't allow data modification. Effort: Medium — requires testing agents after scope reduction. Note: If Reader is needed for cross-RG resource discovery, document the specific feature and leave it in place.
Delta — What Needs to Change
| Change | Priority | Story | Status |
|---|---|---|---|
Create secops_app PostgreSQL role, update connection string | HIGH | LPRIV-003 | Pending Rory approval |
| Investigate subscription-level Reader scope reduction for id-agents-prod | MEDIUM | LPRIV-007 | BACKLOG |
| No other changes needed | — | — | All other permissions minimal |
SOC2 / HIPAA Mapping
| Control | Requirement | Finding |
|---|---|---|
| HIPAA §164.312(a)(1) — Access control | Unique user identification and least privilege | PostgreSQL admin gap identified — remediation in progress |
| SOC2 CC6.3 — Least privilege | Access limited to what is necessary | App reg and managed identities are minimal; DB gap tracked |
| SOC2 CC6.1 — Logical access | Access control policy enforced | Managed identity RBAC is correctly scoped; DB requires fix |
Document History
| Date | Change | Author |
|---|---|---|
| April 2026 | Initial report — LPRIV-001 through LPRIV-006 complete | Kobe |