services / Azure / AKS trusted access role bindings

AKS trusted access role bindings grant an Azure source resource's managed identity a chosen Kubernetes RBAC role inside a managed cluster, establishing cross-resource access into the cluster.

These bindings control privileged, potentially cluster-admin access into AKS, making the asset highly sensitive.

Microsoft.​ContainerService/​managedClusters/​trustedAccessRoleBindings/​delete

Deleting trusted access role bindings removes the RBAC grants tying Azure identities to the cluster, destroying access-control policy and revoking legitimate services' and operators' authorized cluster access.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links