azure-aks-admin-action
Microsoft.ContainerService/managedClusters/* grants full control of the cluster (create/update/delete/stop/rotate/upgradeNodeImageVersion/etc.).
match (effective permission)
{
"action": "Microsoft.ContainerService/managedClusters/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds the managedClusters/* wildcard (Azure Kubernetes Service Contributor / Contributor / Owner)
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <managedCluster> |
| permissions | Microsoft.ContainerService/managedClusters/write |
| conditions | iam_permission service_state |
| state logic | ACTIVE when the principal's role assignment is effective (not denied by a deny assignment) and the cluster is running. CONDITIONAL(deny_assignment) when a deny assignment covers managedClusters/write at the cluster/RG/subscription scope. CONDITIONAL(service_state) when the cluster is stopped. BLOCKED if covered by an effective deny assignment. |
Narrative
{principal.name} has full management control of AKS cluster {target.name} (managedClusters/write), including update, upgrade, and configuration changes.
Raw rule rules/derived/azure/aks.yaml
id: azure-aks-admin-action
emits: CanAdminister
description: Microsoft.ContainerService/managedClusters/* grants full control of the cluster (create/update/delete/stop/rotate/upgradeNodeImageVersion/etc.).
match_effective_permission:
action: Microsoft.ContainerService/managedClusters/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds the managedClusters/* wildcard (Azure Kubernetes Service Contributor / Contributor
/ Owner)
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <managedCluster>
permissions:
- Microsoft.ContainerService/managedClusters/write
conditions:
- iam_permission
- service_state
state_logic: ACTIVE when the principal's role assignment is effective (not denied by a deny assignment)
and the cluster is running. CONDITIONAL(deny_assignment) when a deny assignment covers managedClusters/write
at the cluster/RG/subscription scope. CONDITIONAL(service_state) when the cluster is stopped. BLOCKED
if covered by an effective deny assignment.
confidence: 0.9
derived_from: []
false_positive_note: Azure Kubernetes Service Contributor (managedClusters/* write) does NOT include
Microsoft.Authorization/*/write; the principal cannot grant itself or others RBAC unless it also holds
User Access Administrator. It is still sufficient to call managedClusters/write to disable localAccountsDisabled,
enabling listClusterAdminCredential to return a static cert.
narrative: '{principal.name} has full management control of AKS cluster {target.name} (managedClusters/write),
including update, upgrade, and configuration changes.'