services / Azure / Kubernetes service accounts (connected cluster)

Kubernetes ServiceAccount objects on an Azure Arc-enabled (connected) cluster. These are in-cluster workload identities that pods authenticate as and that are bound to RBAC roles governing what they can do in the cluster.

Service accounts are identities; a service account bound to a privileged ClusterRole can be cluster-admin equivalent, so this asset can be highly sensitive.

Microsoft.​Kubernetes/​connectedClusters/​serviceaccounts/​write

Creating/updating service accounts lets an attacker mint new in-cluster identities (and their tokens) for persistence and obtain principals that can be attached to workloads to gain elevated privileges.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links