services / Azure / Kubernetes service accounts (connected cluster)

Kubernetes ServiceAccount objects on an Azure Arc-enabled (connected) cluster. These are in-cluster workload identities that pods authenticate as and that are bound to RBAC roles governing what they can do in the cluster.

Service accounts are identities; a service account bound to a privileged ClusterRole can be cluster-admin equivalent, so this asset can be highly sensitive.

Microsoft.​Kubernetes/​connectedClusters/​serviceaccounts/​impersonate/​action

The Kubernetes impersonate verb lets the caller act directly as a target service account, assuming its full RBAC permissions — a direct lateral-movement and privilege-escalation primitive to potentially cluster-admin-equivalent identities.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links