services / Azure / Azure Automation certificate asset

An Azure Automation certificate asset stores a certificate (and optionally its private key) within an Automation account for runbooks to use when authenticating to external systems. Control-plane reads return metadata, not the private key material.

Certificate assets are credential material used by runbooks for authentication, so write/delete on them are credential-planting and cryptographic-destruction primitives; the underlying asset is sensitive (HIGH for write/delete).

Microsoft.​Automation/​automationAccounts/​certificates/​write

Creating or updating a certificate asset uploads attacker-controlled certificate/private-key material that runbooks use to authenticate, planting a credential the attacker controls (persistence) and overwriting trusted authentication material (manipulation).

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links