Role Alchemy: Forging Least-Privilege Roles from Cloud Logs...
summary
A PowerShell-driven pipeline converts Azure and Entra ID activity logs into ready-to-deploy JSON role definitions by building a user‑action matrix, applying K‑Means clustering and a custom auto-k algorithm, and emitting RBAC roles that run on PowerShell 7 and Windows PowerShell 5.1. Demos show CSV and Log Analytics inputs, an optional AI assistant for naming, and produced about six clusters on the demo tenant; limitations include 30‑day Entra retention and missing scope metadata.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:55Least privilege in cloud security
- 3:20Activity logs for permissions
- 5:49Glory Roll features
- 7:57Limitations and roadmap
- 9:00Built-in support expansions
- 10:25Demo setup data ingestion
- 17:29K-means clustering
- 23:56Auto-K algorithm summaries
- 25:00JSON role definitions
- 29:33Azure role mining demo
- 33:23Entra ID role mining demo
- 35:50Source code overview
- 37:32Testing custom roles
- 37:52Lessons from Glory Roll
- 40:45Next steps features
- 42:07Q&A
related talks
46mLet Azure control your DevOps Pipelines
46mAn IT Operations Approach to Observability
30mHow to do ALM with Power Platform
01h 05mCreating Azure SQL Database Users Programmatically using Azure DevOps
53mSurprising ways to escalate privileges in Entra ID
29mProper Terraform Authentication for Azure Deployments
55mBuild your Cloud Operating Model on Azure from zero to hero
01h 01mFive best Azure Access Control practice