services / Azure / ARM deployment

An Azure Resource Manager (ARM) deployment is a control-plane record of a template-based provisioning operation at management-group or tenant scope, capturing which resources were deployed and their configuration.

The deployment record itself is metadata/history; the dangerous capability is the write path, which executes an arbitrary template that can provision any resource type including role assignments, managed identities, and compute.

Microsoft.​Resources/​deployments/​write

Creating/updating an ARM deployment executes an arbitrary template that can create role assignments (privilege escalation), assign and act as managed identities (lateral movement), rewrite configuration (manipulation), and provision costly compute (hijack/spend).

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Resource hijacking (MEDIUM)
5. Spend (MEDIUM)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links