services / Azure / AKS managed cluster

An Azure Kubernetes Service (AKS) managed cluster: the control-plane resource that hosts a Kubernetes cluster, its node pools, networking, RBAC/Azure AD integration, and a managed/service-principal identity used to act on Azure resources.

AKS clusters are production compute assets that run workloads, hold in-cluster secrets, and act through a cluster identity; credential-listing and command-execution operations on them are effectively cluster-admin grade and warrant CRITICAL scope.

Microsoft.​ContainerService/​managedClusters/​listClusterMonitoringUserCredential/​action

Returns the clusterMonitoringUser kubeconfig credential granting authenticated, monitoring-scoped access to the cluster API — usable credential material with limited lateral access.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links