azure-aks-list-user-cred
listClusterUserCredential returns a user-level kubeconfig (AAD-token-gated, lower privilege), providing authenticated access to the cluster API server.
match (effective permission)
{
"action": "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Credential |
| source | <principal> |
| target | <user kubeconfig (Credential) for the AKS cluster> |
| permissions | Microsoft.ContainerService/managedClusters/listClusterUserCredential/action |
| conditions | iam_permission service_state |
| state logic | CONDITIONAL(iam_permission) — the returned kubeconfig requires the caller to have a valid Entra token AND sufficient k8s RBAC or Azure RBAC assignment to perform kubectl operations; the kubeconfig itself is not a static credential. The escalation value depends on the k8s RBAC granted to the principal's Entra identity. ACTIVE only when combined with a ClusterRole or Azure RBAC role that grants meaningful k8s verbs. |
Narrative
{principal.name} can obtain a user-level kubeconfig for cluster {target.name} (listClusterUserCredential/action); the actual access is gated by its k8s RBAC grants.
Raw rule rules/derived/azure/aks.yaml
id: azure-aks-list-user-cred
emits: CanReadCredential
description: listClusterUserCredential returns a user-level kubeconfig (AAD-token-gated, lower privilege),
providing authenticated access to the cluster API server.
match_effective_permission:
action: Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Credential
source: <principal>
target: <user kubeconfig (Credential) for the AKS cluster>
permissions:
- Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
conditions:
- iam_permission
- service_state
state_logic: "CONDITIONAL(iam_permission) \u2014 the returned kubeconfig requires the caller to have\
\ a valid Entra token AND sufficient k8s RBAC or Azure RBAC assignment to perform kubectl operations;\
\ the kubeconfig itself is not a static credential. The escalation value depends on the k8s RBAC\
\ granted to the principal's Entra identity. ACTIVE only when combined with a ClusterRole or Azure\
\ RBAC role that grants meaningful k8s verbs."
confidence: 0.75
derived_from:
- <HasPermission edge_id (managedClusters/listClusterUserCredential/action)>
false_positive_note: The user kubeconfig alone is not a privilege escalation; it is an authenticated
API-server entry point. The actual k8s verb access depends on the Entra principal's ClusterRoleBinding
/ RoleBinding / Azure RBAC assignment. Do NOT emit CanExecuteCommand solely from listClusterUserCredential
without also confirming the principal holds sufficient k8s RBAC (pods/exec or cluster-admin).
narrative: '{principal.name} can obtain a user-level kubeconfig for cluster {target.name} (listClusterUserCredential/action);
the actual access is gated by its k8s RBAC grants.'