services / Azure / Kubernetes service accounts (connected cluster)

Kubernetes ServiceAccount objects on an Azure Arc-enabled (connected) cluster. These are in-cluster workload identities that pods authenticate as and that are bound to RBAC roles governing what they can do in the cluster.

Service accounts are identities; a service account bound to a privileged ClusterRole can be cluster-admin equivalent, so this asset can be highly sensitive.

Microsoft.​Kubernetes/​connectedClusters/​serviceaccounts/​delete

Deleting service accounts destroys in-cluster identities, breaking legitimate workloads' authentication and denying authorized operational access.

Risks

1. Account destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links