services / Azure / Azure Automation DSC node configuration

An Azure Automation DSC Node Configuration is a compiled Desired State Configuration (MOF) document that defines and is enforced on managed nodes (VMs/servers) registered to the Automation account.

MOF content can embed sensitive settings, file paths, and (in poorly-secured configs) credentials, and reveals exactly how the managed fleet is configured.

Microsoft.​Automation/​automationAccounts/​nodeConfigurations/​rawContent/​action

Returns the raw compiled MOF content of a node configuration, exposing the exact configuration applied to managed nodes and any embedded sensitive settings or credentials.

Risks

1. Data exfiltration (CRITICAL)
2. Infrastructure discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links