iac/iam/iam-azure-rbac-contributor

Azure RBAC Contributor role assigned

mediumCloud IAMiac-iam

What it detects

The Azure built-in `Contributor` role grants full management of all resources in the scope (everything except granting access). It's broader than most workloads need and removes the blast-radius boundary.

Remediation

Assign a service-specific built-in role (e.g. `Storage Blob Data Contributor`) scoped to the resource the identity actually uses.

How it runs

Run against JSON/YAML/source files. AWS IAM rules require a policy-document context (Statement + Effect); GCP primitive roles are matched anywhere. HCL is left to the Terraform layer.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.