services / Azure / AKS managed cluster

An Azure Kubernetes Service (AKS) managed cluster: the control-plane resource that hosts a Kubernetes cluster, its node pools, networking, RBAC/Azure AD integration, and a managed/service-principal identity used to act on Azure resources.

AKS clusters are production compute assets that run workloads, hold in-cluster secrets, and act through a cluster identity; credential-listing and command-execution operations on them are effectively cluster-admin grade and warrant CRITICAL scope.

Microsoft.​ContainerService/​managedClusters/​listClusterUserCredential/​action

Returns the clusterUser kubeconfig credential for authenticating to the Kubernetes API; privilege depends on AAD/in-cluster RBAC, but for AAD-disabled clusters it is admin-equivalent.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links