azure-aks-admin-cred-executes-as

Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide summary edge; per-pod edges from container-chains cluster-rbac-exec).

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'workload': None} {'workload': None} ExecutesAs {'workload_identity': None}

where

node_type(?workload) in [KubernetesWorkload, Container] node_type(?workload_identity) in [WorkloadIdentity, ManagedIdentity, MachineIdentity, ServiceAccount] ?workload is a workload in an AKS cluster for which ?principal holds cluster-admin credential or Azure RBAC Cluster Admin

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?workload_identity`
permissions	`Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action`
conditions	`service_state` `token_mounted`
state logic	inherit from CanExecuteCommand: ACTIVE when the cluster-admin credential is ACTIVE and the pod is running with its SA token mounted; CONDITIONAL(token_mounted) when automountServiceAccountToken: false; CONDITIONAL(service_state) when the cluster is stopped. Dedupes with container-chains cluster-rbac-exec on (CanExecuteAs, ?principal, ?workload_identity) — same collapse, AKS-credential framing.

Narrative

{principal.name} holds the cluster-admin kubeconfig for {cluster.name} and can exec into {workload.name}, which runs as {workload_identity.name}; the mounted SA token is readable from inside the container, so {principal.name} executes as {workload_identity.name}.

Raw rule rules/derived/azure/aks.yaml

id: azure-aks-admin-cred-executes-as
emits: CanExecuteAs
description: Cluster-admin kubeconfig -> exec any pod -> execute as every pod workload identity (cluster-wide
  summary edge; per-pod edges from container-chains cluster-rbac-exec).
match:
- - principal: null
  - CanExecuteCommand
  - workload: null
- - workload: null
  - ExecutesAs
  - workload_identity: null
where:
- node_type(?workload) in [KubernetesWorkload, Container]
- node_type(?workload_identity) in [WorkloadIdentity, ManagedIdentity, MachineIdentity, ServiceAccount]
- ?workload is a workload in an AKS cluster for which ?principal holds cluster-admin credential or Azure
  RBAC Cluster Admin
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?workload_identity
  permissions:
  - Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action
  conditions:
  - service_state
  - token_mounted
  state_logic: "inherit from CanExecuteCommand: ACTIVE when the cluster-admin credential is ACTIVE and\
    \ the pod is running with its SA token mounted; CONDITIONAL(token_mounted) when automountServiceAccountToken:\
    \ false; CONDITIONAL(service_state) when the cluster is stopped.  Dedupes with container-chains cluster-rbac-exec\
    \ on (CanExecuteAs, ?principal, ?workload_identity) \u2014 same collapse, AKS-credential framing."
  confidence: 0.95
  derived_from:
  - <CanExecuteCommand edge_id (azure-aks-admin-cred-execute-command)>
  - <ExecutesAs edge_id>
  - container-chains.yaml#cluster-rbac-exec
  - can-execute-as.yaml#execute-as-via-command
  false_positive_note: "This dedupes with container-chains cluster-rbac-exec on (CanExecuteAs, ?principal,\
    \ ?workload_identity) \u2014 emit once, do not double-count weight.  The escalation consequence (privilege_level\
    \ guard) is can-control's escalate-via-execute-as \u2014 not re-derived here.  Honor automountServiceAccountToken:\
    \ false \u2014 no token mount means no identity to execute as (CONDITIONAL(token_mounted))."
  narrative: '{principal.name} holds the cluster-admin kubeconfig for {cluster.name} and can exec into
    {workload.name}, which runs as {workload_identity.name}; the mounted SA token is readable from inside
    the container, so {principal.name} executes as {workload_identity.name}.'