azure-aks-run-command
managedClusters/runCommand/action runs arbitrary kubectl/helm inside the cluster, bypassing network isolation; equivalent to cluster-wide kubectl exec.
match (effective permission)
{
"action": "Microsoft.ContainerService/managedClusters/runCommand/action",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds runCommand/action at the cluster scope
emit
| source type | Identity |
|---|---|
| target type | KubernetesWorkload |
| source | <principal> |
| target | <KubernetesCluster (representing all workloads within)> |
| permissions | Microsoft.ContainerService/managedClusters/runCommand/action |
| conditions | service_state |
| state logic | ACTIVE when the cluster powerState.code == Running. CONDITIONAL(service_state) when the cluster is stopped. runCommand bypasses API-server network restrictions (private clusters, authorized-IP ranges) — do NOT downgrade to CONDITIONAL(network_reachability) for private clusters. BLOCKED if a deny assignment covers runCommand/action at the cluster/RG/subscription scope. |
Narrative
{principal.name} holds managedClusters/runCommand/action on cluster {target.name} and can run arbitrary kubectl / helm commands inside the cluster from the ARM plane, bypassing network isolation and achieving cluster-wide code execution.
Raw rule rules/derived/azure/aks.yaml
id: azure-aks-run-command
emits: CanExecuteCommand
description: managedClusters/runCommand/action runs arbitrary kubectl/helm inside the cluster, bypassing
network isolation; equivalent to cluster-wide kubectl exec.
match_effective_permission:
action: Microsoft.ContainerService/managedClusters/runCommand/action
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds runCommand/action at the cluster scope
emit:
source_type: Identity
target_type: KubernetesWorkload
source: <principal>
target: <KubernetesCluster (representing all workloads within)>
permissions:
- Microsoft.ContainerService/managedClusters/runCommand/action
conditions:
- service_state
state_logic: "ACTIVE when the cluster powerState.code == Running. CONDITIONAL(service_state) when the\
\ cluster is stopped. runCommand bypasses API-server network restrictions (private clusters, authorized-IP\
\ ranges) \u2014 do NOT downgrade to CONDITIONAL(network_reachability) for private clusters. BLOCKED\
\ if a deny assignment covers runCommand/action at the cluster/RG/subscription scope."
confidence: 0.95
false_positive_note: "runCommand operates on the ARM plane, not the network plane \u2014 it reaches\
\ private clusters that are not network-accessible. Do NOT treat network isolation as a blocker.\
\ The command runs in a temporary pod in the kube-system namespace as a privileged identity; the\
\ effective authorization depends on the cluster's RBAC mode (Azure RBAC or k8s RBAC). When Azure\
\ RBAC is enabled, the caller's ARM RBAC on the cluster determines what runCommand can perform \u2014\
\ but in practice `runCommand` itself is an administrative action; treat it as cluster-admin equiv\
\ for path-finding purposes."
narrative: '{principal.name} holds managedClusters/runCommand/action on cluster {target.name} and can
run arbitrary kubectl / helm commands inside the cluster from the ARM plane, bypassing network isolation
and achieving cluster-wide code execution.'