azure-aks-run-command-executes-as

runCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by exec-ing into the pod (container-chains cluster-rbac-exec).

derived azure emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?workload_identity`
permissions	`Microsoft.ContainerService/managedClusters/runCommand/action`
conditions	`service_state` `token_mounted`
state logic	inherit from CanExecuteCommand: ACTIVE when the cluster is running and the SA token is mounted; CONDITIONAL(token_mounted) when automountServiceAccountToken: false; CONDITIONAL(service_state) when cluster is stopped.

source type

Identity

target type

Identity

source

?principal

target

?workload_identity

permissions

Microsoft.ContainerService/managedClusters/runCommand/action

conditions

service_state token_mounted

state logic

inherit from CanExecuteCommand: ACTIVE when the cluster is running and the SA token is mounted; CONDITIONAL(token_mounted) when automountServiceAccountToken: false; CONDITIONAL(service_state) when cluster is stopped.

Narrative

{principal.name} can exec into {workload.name} via runCommand on the cluster; {workload.name} runs as {workload_identity.name}; the mounted SA token is readable from inside the exec session, so {principal.name} executes as {workload_identity.name}.

Raw rule rules/derived/azure/aks.yaml

id: azure-aks-run-command-executes-as
emits: CanExecuteAs
description: runCommand grants cluster-wide kubectl exec; any pod's workload identity is reachable by
  exec-ing into the pod (container-chains cluster-rbac-exec).
match:
- - principal: null
  - CanExecuteCommand
  - workload: null
- - workload: null
  - ExecutesAs
  - workload_identity: null
where:
- node_type(?workload) in [KubernetesWorkload, Container]
- ?principal's CanExecuteCommand is from azure-aks-run-command (runCommand/action)
- node_type(?workload_identity) in [WorkloadIdentity, ManagedIdentity, MachineIdentity, ServiceAccount]
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?workload_identity
  permissions:
  - Microsoft.ContainerService/managedClusters/runCommand/action
  conditions:
  - service_state
  - token_mounted
  state_logic: 'inherit from CanExecuteCommand: ACTIVE when the cluster is running and the SA token is
    mounted; CONDITIONAL(token_mounted) when automountServiceAccountToken: false; CONDITIONAL(service_state)
    when cluster is stopped.'
  confidence: 0.95
  derived_from:
  - <CanExecuteCommand edge_id (azure-aks-run-command)>
  - <ExecutesAs edge_id>
  - container-chains.yaml#cluster-rbac-exec
  - can-execute-as.yaml#execute-as-via-command
  false_positive_note: "Dedupes with container-chains cluster-rbac-exec and azure-aks-admin-cred-executes-as\
    \ on (CanExecuteAs, ?principal, ?workload_identity); emit once.  The escalation roll-up is can-control\
    \ escalate-via-execute-as \u2014 not re-derived here.  Honor automountServiceAccountToken: false (CONDITIONAL(token_mounted))."
  narrative: '{principal.name} can exec into {workload.name} via runCommand on the cluster; {workload.name}
    runs as {workload_identity.name}; the mounted SA token is readable from inside the exec session, so
    {principal.name} executes as {workload_identity.name}.'