Skip to content
Forestall

AZ_AKS_CONTRIBUTOR

Copy page

Summary
Forestall ACL Alias AZ_AKS_CONTRIBUTOR
Azure Alias AKS Contributor / Azure Kubernetes Service Contributor
Affected Object Types Managed Kubernetes Clusters (AKS)
Exploitation Certainty Certain
Azure RBAC Roles Azure Kubernetes Service Contributor Role (ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8), Azure Kubernetes Service Cluster Admin Role (0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8), Contributor (b24988ac-6180-42a0-ab88-20f7382dd24c)

Description

Grants administrative access to AKS clusters. Exploitation paths:

Method Permission Impact
List Admin Credentials listClusterAdminCredential/action Full cluster-admin kubeconfig
Run Command runCommand/action Execute commands in cluster
Managed Identity Via pod/node Pivot to Azure resources

Identification

PowerShell

# List AKS Contributor role assignments
$aksRoles = @("Azure Kubernetes Service Contributor Role", "Azure Kubernetes Service Cluster Admin Role")
Get-AzRoleAssignment | Where-Object { $aksRoles -contains $_.RoleDefinitionName } | Format-Table DisplayName, SignInName, RoleDefinitionName, Scope -AutoSize


# Check specific cluster
Get-AzRoleAssignment -Scope "/subscriptions/<SubId>/resourceGroups/<RGName>/providers/Microsoft.ContainerService/managedClusters/<ClusterName>" | Format-Table DisplayName, RoleDefinitionName, ObjectType -AutoSize


# List all AKS clusters
Get-AzAksCluster | Select-Object Name, ResourceGroupName, Location, ProvisioningState

Exploitation

With AKS Contributor access, use either method to gain full cluster control:

Mitigation

  1. Use Microsoft Entra integration - disable local admin accounts
  2. Minimize AKS Contributor assignments - use Cluster User Role for read-only; scope to specific clusters
  3. Enable Kubernetes RBAC - don’t grant cluster-admin by default
  4. Restrict Run Command - use Azure Policy; monitor usage
  5. Secure managed identities - use workload identity; apply least privilege

Detection

Use the Azure Portal:

  1. Open Azure Portal -> Monitor -> Activity log.
  2. Filter by Resource type: Kubernetes Services (or scope to the target AKS cluster).
  3. Review operations such as:
    • List Cluster Admin Credential - someone retrieved the admin kubeconfig.
    • Run Command - command execution within the cluster.
    • Create/Update role assignment - new permissions granted on AKS resources.
  4. Click an event and review Caller, Source IP, Time, and Status for unusual principals, off-hours activity, or requests from unexpected IP addresses.
  5. On the AKS cluster blade, open Access control (IAM) -> Role assignments to confirm any newly assigned roles.

References

Was this page helpful?

Thank you for your feedback.