Skip to content

Commit b5d9ba0

Browse files
committed
fixed warnings
1 parent ca47eb0 commit b5d9ba0

File tree

3 files changed

+2
-4
lines changed

3 files changed

+2
-4
lines changed

articles/automation/automation-role-based-access-control.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,6 @@ Update Management can be used to assess and schedule update deployments to machi
311311

312312
|**Resource** |**Role** |**Scope** |
313313
|---------|---------|---------|
314-
|Automation account |[Custom Azure Automation Contributor role](#custom-azure-automation-contributor-role) |Automation account |
315314
|Automation account |Virtual Machine Contributor |Resource Group for the account |
316315
|Log Analytics workspace | Log Analytics Contributor|Log Analytics workspace |
317316
|Log Analytics workspace |Log Analytics Reader|Subscription|

articles/automation/automation-security-overview.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ To be able to create or update the Automation account, you need to be a member o
9292

9393
- [Owner](./automation-role-based-access-control.md#owner)
9494
- [Contributor](./automation-role-based-access-control.md#contributor)
95-
- [Custom Azure Automation Contributor](./automation-role-based-access-control.md#custom-azure-automation-contributor-role)
9695

9796
To learn more about the Azure Resource Manager and Classic deployment models, see [Resource Manager and classic deployment](../azure-resource-manager/management/deployment-models.md).
9897

@@ -171,7 +170,7 @@ Role-based access control is available with Azure Resource Manager to grant perm
171170
If you have strict security controls for permission assignment in resource groups, you need to assign the Run As account membership to the **Contributor** role in the resource group.
172171

173172
> [!NOTE]
174-
> We recommend you don't use the **Log Analytics Contributor** role to execute Automation jobs. Instead, create the Azure Automation Contributor custom role and use it for actions related to the Automation account. For more information, see [Custom Azure Automation Contributor role](./automation-role-based-access-control.md#custom-azure-automation-contributor-role).
173+
> We recommend you don't use the **Log Analytics Contributor** role to execute Automation jobs. Instead, create the Azure Automation Contributor custom role and use it for actions related to the Automation account.
175174
176175
## Runbook authentication with Hybrid Runbook Worker
177176

articles/automation/whats-new.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ For more information, see [Use of customer-managed keys](automation-secure-asset
126126

127127
Microsoft intends to remove the Automation account rights from the Log Analytics Contributor role. Currently, the built-in [Log Analytics Contributor](./automation-role-based-access-control.md#log-analytics-contributor) role can escalate privileges to the subscription [Contributor](./../role-based-access-control/built-in-roles.md#contributor) role. Since Automation account Run As accounts are initially configured with Contributor rights on the subscription, it can be used by an attacker to create new runbooks and execute code as a Contributor on the subscription.
128128

129-
As a result of this security risk, we recommend you don't use the Log Analytics Contributor role to execute Automation jobs. Instead, create the Azure Automation Contributor custom role and use it for actions related to the Automation account. For implementation steps, see [Custom Azure Automation Contributor role](./automation-role-based-access-control.md#custom-azure-automation-contributor-role).
129+
As a result of this security risk, we recommend you don't use the Log Analytics Contributor role to execute Automation jobs. Instead, create the Azure Automation Contributor custom role and use it for actions related to the Automation account.
130130

131131
### Support for Automation and State Configuration available in West US 3
132132

0 commit comments

Comments
 (0)