azure-aks-rbac-cluster-admin-grant
A principal with roleAssignments/write or Owner role can grant the Azure Kubernetes Service RBAC Cluster Admin role to any principal.
match (effective permission)
{
"action": "Microsoft.Authorization/roleAssignments/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Microsoft.Authorization/roleAssignments/write at the cluster scope or
ResourceGroup/subscription
cluster has aadProfile.enableAzureRBAC: true (Azure RBAC mode enabled)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <any Identity that can be assigned the RBAC Cluster Admin role> |
| permissions | Microsoft.Authorization/roleAssignments/write |
| conditions | iam_permission service_state |
| state logic | ACTIVE when the principal holds roleAssignments/write at cluster/RG/subscription scope and Azure RBAC mode is enabled. CONDITIONAL(iam_permission) when the scope is uncertain. BLOCKED if a deny assignment covers roleAssignments/write or if Azure RBAC mode is disabled (enableAzureRBAC: false). |
Narrative
{principal.name} holds Microsoft.Authorization/roleAssignments/write on cluster {cluster.name} and can grant the Azure Kubernetes Service RBAC Cluster Admin role to any principal, enabling that principal to execute commands on any pod in the cluster.
Raw rule rules/derived/azure/aks.yaml
id: azure-aks-rbac-cluster-admin-grant
emits: CanGrantPermission
description: A principal with roleAssignments/write or Owner role can grant the Azure Kubernetes Service
RBAC Cluster Admin role to any principal.
match_effective_permission:
action: Microsoft.Authorization/roleAssignments/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Microsoft.Authorization/roleAssignments/write at the cluster scope or ResourceGroup/subscription
- 'cluster has aadProfile.enableAzureRBAC: true (Azure RBAC mode enabled)'
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <any Identity that can be assigned the RBAC Cluster Admin role>
permissions:
- Microsoft.Authorization/roleAssignments/write
conditions:
- iam_permission
- service_state
state_logic: 'ACTIVE when the principal holds roleAssignments/write at cluster/RG/subscription scope
and Azure RBAC mode is enabled. CONDITIONAL(iam_permission) when the scope is uncertain. BLOCKED if
a deny assignment covers roleAssignments/write or if Azure RBAC mode is disabled (enableAzureRBAC:
false).'
confidence: 0.9
derived_from: []
false_positive_note: "roleAssignments/write at the cluster scope allows role assignment specifically\
\ for RBAC roles defined in that cluster's Azure RBAC scope. The grantee must hold a compatible assignable\
\ role (e.g., not system-internal roles). Verify the principal's scope when evaluating the blast radius\
\ \u2014 subscription-level roleAssignments/write is broader than cluster-level."
narrative: '{principal.name} holds Microsoft.Authorization/roleAssignments/write on cluster {cluster.name}
and can grant the Azure Kubernetes Service RBAC Cluster Admin role to any principal, enabling that
principal to execute commands on any pod in the cluster.'