services / Azure / Cosmos DB SQL role assignment

A Cosmos DB native (SQL API) data-plane RBAC role assignment binding a principal to a SQL role definition at a scope within a database account.

Access-control binding governing which identities can read and write the production database's data plane; creating/deleting these directly controls data access.

Microsoft.​DocumentDB/​databaseAccounts/​sqlRoleAssignments/​delete

Deleting a SQL role assignment destroys a data-plane access binding, stripping legitimate principals of access (denial-of-access) and tearing down grants that would otherwise constrain the attacker.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links