azure-aks-admin-cred-execute-command

A cluster-admin kubeconfig (from listClusterAdminCredential) grants kubectl exec into any pod in the cluster.

derived azure emits CanExecuteCommand

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`KubernetesWorkload`
source	`?principal`
target	`<every KubernetesWorkload / Container in the cluster associated with ?admin_kubeconfig>`
permissions	`Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action`
conditions	`service_state`
state logic	inherit from the contributing CanReadCredential: ACTIVE when the cluster-admin kubeconfig is ACTIVE (local accounts enabled, cluster running); CONDITIONAL when the kubeconfig is CONDITIONAL (local accounts disabled or cluster stopped). BLOCKED if the CanReadCredential is BLOCKED.

source type

Identity

target type

KubernetesWorkload

source

?principal

target

<every KubernetesWorkload / Container in the cluster associated with ?admin_kubeconfig>

permissions

Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action

conditions

service_state

state logic

inherit from the contributing CanReadCredential: ACTIVE when the cluster-admin kubeconfig is ACTIVE (local accounts enabled, cluster running); CONDITIONAL when the kubeconfig is CONDITIONAL (local accounts disabled or cluster stopped). BLOCKED if the CanReadCredential is BLOCKED.

Narrative

{principal.name} retrieved the cluster-admin kubeconfig for {cluster.name} (listClusterAdminCredential/action) and can kubectl exec into any pod in the cluster.

Raw rule rules/derived/azure/aks.yaml

id: azure-aks-admin-cred-execute-command
emits: CanExecuteCommand
description: A cluster-admin kubeconfig (from listClusterAdminCredential) grants kubectl exec into any
  pod in the cluster.
match:
- - principal: null
  - CanReadCredential
  - admin_kubeconfig: null
where:
- node_type(?admin_kubeconfig) == Credential
- ?admin_kubeconfig is a cluster-admin kubeconfig for an AKS managedCluster (produced by azure-aks-list-admin-cred)
emit:
  source_type: Identity
  target_type: KubernetesWorkload
  source: ?principal
  target: <every KubernetesWorkload / Container in the cluster associated with ?admin_kubeconfig>
  permissions:
  - Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action
  conditions:
  - service_state
  state_logic: 'inherit from the contributing CanReadCredential: ACTIVE when the cluster-admin kubeconfig
    is ACTIVE (local accounts enabled, cluster running); CONDITIONAL when the kubeconfig is CONDITIONAL
    (local accounts disabled or cluster stopped). BLOCKED if the CanReadCredential is BLOCKED.'
  confidence: 0.95
  derived_from:
  - <CanReadCredential edge_id (azure-aks-list-admin-cred)>
  false_positive_note: "The cluster-admin kubeconfig grants pods/exec on ALL namespaces; each (pod, workload_identity)\
    \ pair is a distinct CanExecuteCommand edge feeding container-chains cluster-rbac-exec -> CanExecuteAs.\
    \  Scope the exec to the ACTUAL pod/namespace pairs in the cluster \u2014 not an abstract \"cluster\
    \ node.\" The CanExecuteCommand source set (schema) admits KubernetesWorkload; target the workload\
    \ node or a placeholder cluster-wide KubernetesWorkload node depending on how the collector models\
    \ all-namespace exec. Do NOT emit if CanReadCredential is CONDITIONAL(localAccountsDisabled) \u2014\
    \ the AAD-gated path requires additional Entra permission checks."
  narrative: '{principal.name} retrieved the cluster-admin kubeconfig for {cluster.name} (listClusterAdminCredential/action)
    and can kubectl exec into any pod in the cluster.'