azure-aks-write-config

id: azure-aks-write-config
emits: CanModifyConfiguration
description: "managedClusters/write can disable local account restrictions, change the OIDC issuer, swap\
  \ kubelet MI, or alter network egress \u2014 configuration changes that unlock or change escalation\
  \ paths."
match_effective_permission:
  action: Microsoft.ContainerService/managedClusters/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <managedCluster>
  permissions:
  - Microsoft.ContainerService/managedClusters/write
  conditions:
  - service_state
  - iam_permission
  state_logic: "CONDITIONAL(service_state, iam_permission) \u2014 the config change is an indirect escalation\
    \ requiring further steps: setting disableLocalAccounts: false unlocks azure-aks-list-admin-cred;\
    \ swapping kubelet MI unlocks azure-aks-node-imds-executes-as (requires Microsoft.ManagedIdentity/.../assign\
    \ on target MI); disabling Azure RBAC downgrades cluster-admin enforcement; modifying authorizedIPRanges\
    \ extends network reachability. The escalation path is CONDITIONAL on the downstream exploitation\
    \ step."
  confidence: 0.85
  derived_from: []
  false_positive_note: "managedClusters/write grants configuration change, not direct code execution \u2014\
    \ the escalation is indirect (changes unlock other paths).  Model as CONDITIONAL(service_state) when\
    \ downstream exploitation of the config change requires additional steps. Downstream paths: (1) disableLocalAccounts:\
    \ false + azure-aks-list-admin-cred; (2) kubelet MI swap requires Microsoft.ManagedIdentity/.../assign\
    \ on the target MI + azure-aks-node-imds-executes-as; (3) disabling enableAzureRBAC bypasses Azure\
    \ RBAC cluster-admin enforcement; (4) authorizedIPRanges changes unlock network reachability for unauthenticated\
    \ clients.  See azure-aks-swap-kubelet-mi for the composed escalation path (managedClusters/agentPools/write\
    \ + assign on MI)."
  narrative: "{principal.name} can update the configuration of AKS cluster {target.name} (managedClusters/write),\
    \ enabling escalation by re-enabling local accounts (unlocking azure-aks-list-admin-cred static cert),\
    \ swapping the kubelet MI to a more-privileged identity, altering RBAC mode (Azure RBAC \u2192 k8s-only),\
    \ or modifying authorized IP ranges."