services / Azure / Arc-connected Kubernetes clusters

An Azure Arc connectedCluster is the Azure-side control-plane projection of an external/on-prem Kubernetes cluster, holding onboarding configuration, agent settings, distribution metadata, and an optional system-assigned managed identity. Through it Azure manages, governs, and brokers credentialed access to a production Kubernetes cluster.

Arc-connected clusters back production container workloads; control over the connectedCluster resource and its credential actions can yield in-cluster access, so the asset is high-to-critical sensitivity.

Microsoft.​Kubernetes/​connectedClusters/​listClusterUserCredential/​action

Returns the clusterUser kubeconfig credential for the Arc-connected cluster (GA), exporting usable credential material that yields direct in-cluster API access for lateral movement and identity takeover.

Risks

1. Account takeover (CRITICAL)
2. Cryptographic exfiltration (CRITICAL)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links