azure-aks-rbac-cluster-admin-exec
Azure Kubernetes Service RBAC Cluster Admin role (Azure RBAC mode) maps to k8s cluster-admin, granting kubectl exec on every pod.
match (effective permission)
{
"note": "The RBAC Cluster Admin role is detected by role-assignment lookup (roleDefinitionId b1ff04bb-\u2026), not by checking a specific data-plane action. The canonical data-plane permission for pods/exec is Microsoft.ContainerService/managedClusters/pods/exec/action.",
"role_definition_id": "b1ff04bb-8a4e-4dc4-8eb5-8693973ce19a",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal holds the 'Azure Kubernetes Service RBAC Cluster Admin' role (b1ff04bb-8a4e-4dc4-8eb5-8693973ce19a) on the cluster
cluster has aadProfile.enableAzureRBAC: true (Azure RBAC mode enabled)
emit
| source type | Identity |
|---|---|
| target type | KubernetesWorkload |
| source | <principal> |
| target | <every KubernetesWorkload in the cluster> |
| permissions | Microsoft.ContainerService/managedClusters/pods/exec/action |
| conditions | service_state iam_permission |
| state logic | ACTIVE when the cluster has enableAzureRBAC: true AND the principal's role assignment is effective (not denied) AND the cluster is running. CONDITIONAL(iam_permission) when enableAzureRBAC status is unknown. BLOCKED if a deny assignment covers the role or if the cluster uses k8s-only RBAC mode (enableAzureRBAC: false) — in that case this Entra role has NO in-cluster authorization effect. |
Narrative
{principal.name} holds the Azure Kubernetes Service RBAC Cluster Admin role on cluster {target.name} (Azure RBAC mode enabled), which maps to k8s cluster-admin and grants kubectl exec on every pod in the cluster.
Raw rule rules/derived/azure/aks.yaml
id: azure-aks-rbac-cluster-admin-exec
emits: CanExecuteCommand
description: Azure Kubernetes Service RBAC Cluster Admin role (Azure RBAC mode) maps to k8s cluster-admin,
granting kubectl exec on every pod.
match_effective_permission:
role_definition_id: b1ff04bb-8a4e-4dc4-8eb5-8693973ce19a
scope_type: resource|resourceGroup|subscription
note: "The RBAC Cluster Admin role is detected by role-assignment lookup (roleDefinitionId b1ff04bb-\u2026\
), not by checking a specific data-plane action. The canonical data-plane permission for pods/exec\
\ is Microsoft.ContainerService/managedClusters/pods/exec/action."
where:
- principal holds the 'Azure Kubernetes Service RBAC Cluster Admin' role (b1ff04bb-8a4e-4dc4-8eb5-8693973ce19a)
on the cluster
- 'cluster has aadProfile.enableAzureRBAC: true (Azure RBAC mode enabled)'
emit:
source_type: Identity
target_type: KubernetesWorkload
source: <principal>
target: <every KubernetesWorkload in the cluster>
permissions:
- Microsoft.ContainerService/managedClusters/pods/exec/action
conditions:
- service_state
- iam_permission
state_logic: "ACTIVE when the cluster has enableAzureRBAC: true AND the principal's role assignment\
\ is effective (not denied) AND the cluster is running. CONDITIONAL(iam_permission) when enableAzureRBAC\
\ status is unknown. BLOCKED if a deny assignment covers the role or if the cluster uses k8s-only\
\ RBAC mode (enableAzureRBAC: false) \u2014 in that case this Entra role has NO in-cluster authorization\
\ effect."
confidence: 0.9
derived_from: []
false_positive_note: "This is ONLY valid when the cluster's aadProfile.enableAzureRBAC is true. On a\
\ cluster with only k8s RBAC (Kubernetes-native ClusterRoleBindings), the \"Azure Kubernetes Service\
\ RBAC Cluster Admin\" Entra role DOES NOT grant any k8s authorization \u2014 do NOT emit. Verify\
\ enableAzureRBAC: true before emitting. If unsure, emit CONDITIONAL(iam_permission)."
narrative: '{principal.name} holds the Azure Kubernetes Service RBAC Cluster Admin role on cluster {target.name}
(Azure RBAC mode enabled), which maps to k8s cluster-admin and grants kubectl exec on every pod in
the cluster.'