services / Azure / Kubernetes ConfigMaps (AKS)

Kubernetes ConfigMaps store non-secret application and cluster configuration (settings, endpoints, scripts) consumed by workloads in an AKS managed cluster.

Although not formal Secrets, ConfigMaps frequently contain sensitive operational data and misplaced credentials/connection strings, and config like CoreDNS or app settings is consumed/executed by pods.

Microsoft.​ContainerService/​managedClusters/​configmaps/​write

Alters configuration consumed by workloads; tampering with config (CoreDNS, app settings, mounted scripts) can redirect or poison pods and pivot into running workload identities.

Risks

1. Data manipulation (HIGH)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links