services / Azure / Kubernetes role bindings (Arc connected cluster)

RoleBinding objects in the Kubernetes RBAC API of an Azure Arc connected cluster. They grant the permissions of a (cluster)role to specific subjects (users, groups, service accounts) within a namespace.

RoleBindings are the assignment graph mapping identities to permissions; modifying them directly changes who holds what access in the cluster.

Microsoft.​Kubernetes/​connectedClusters/​rbac.​authorization.​k8s.​io/​rolebindings/​delete

Deleting a RoleBinding removes an RBAC grant, destroying access-control policy and revoking authorized principals' access (denial-of-access).

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links