> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_aks_contributor.md).

# AZ\_AKS\_CONTRIBUTOR

## Summary

|                            |                                                                                                                                                                                                                                |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Forestall ACL Alias**    | AZ\_AKS\_CONTRIBUTOR                                                                                                                                                                                                           |
| **Azure Alias**            | AKS Contributor / Azure Kubernetes Service Contributor                                                                                                                                                                         |
| **Affected Object Types**  | Managed Kubernetes Clusters (AKS)                                                                                                                                                                                              |
| **Exploitation Certainty** | Certain                                                                                                                                                                                                                        |
| **Azure RBAC Roles**       | Azure Kubernetes Service Contributor Role (`ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8`), Azure Kubernetes Service Cluster Admin Role (`0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8`), Contributor (`b24988ac-6180-42a0-ab88-20f7382dd24c`) |

## Description

Grants administrative access to AKS clusters. Exploitation paths:

| Method                                                                                                      | Permission                          | Impact                        |
| ----------------------------------------------------------------------------------------------------------- | ----------------------------------- | ----------------------------- |
| [List Admin Credentials](https://docs.forestall.io/fsprotect/edges/azure/az_list_cluster_admin_credentials) | `listClusterAdminCredential/action` | Full cluster-admin kubeconfig |
| [Run Command](https://docs.forestall.io/fsprotect/edges/azure/az_execute_command)                           | `runCommand/action`                 | Execute commands in cluster   |
| Managed Identity                                                                                            | Via pod/node                        | Pivot to Azure resources      |

## Identification

### PowerShell

```powershell
# List AKS Contributor role assignments
$aksRoles = @("Azure Kubernetes Service Contributor Role", "Azure Kubernetes Service Cluster Admin Role")
Get-AzRoleAssignment | Where-Object { $aksRoles -contains $_.RoleDefinitionName } | Format-Table DisplayName, SignInName, RoleDefinitionName, Scope -AutoSize

# Check specific cluster
Get-AzRoleAssignment -Scope "/subscriptions/<SubId>/resourceGroups/<RGName>/providers/Microsoft.ContainerService/managedClusters/<ClusterName>" | Format-Table DisplayName, RoleDefinitionName, ObjectType -AutoSize

# List all AKS clusters
Get-AzAksCluster | Select-Object Name, ResourceGroupName, Location, ProvisioningState
```

### Azure Portal

Navigate to the target AKS cluster, then **Access control (IAM)** -> **Role assignments** to view who has contributor-level access.

## Exploitation

With AKS Contributor access, use either method to gain full cluster control:

* [**AZ\_LIST\_CLUSTER\_ADMIN\_CREDENTIALS**](https://docs.forestall.io/fsprotect/edges/azure/az_list_cluster_admin_credentials) - get cluster-admin kubeconfig (bypasses Kubernetes RBAC)
* [**AZ\_EXECUTE\_COMMAND**](https://docs.forestall.io/fsprotect/edges/azure/az_execute_command) - run commands in cluster context via Run Command API

## Mitigation

1. **Use Microsoft Entra integration** - disable local admin accounts
2. **Minimize AKS Contributor assignments** - use Cluster User Role for read-only; scope to specific clusters
3. **Enable Kubernetes RBAC** - don't grant cluster-admin by default
4. **Restrict Run Command** - use Azure Policy; monitor usage
5. **Secure managed identities** - use workload identity; apply least privilege

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> **Monitor** -> **Activity log**.
2. Filter by **Resource type**: `Kubernetes Services` (or scope to the target AKS cluster).
3. Review operations such as:
   * `List Cluster Admin Credential` - someone retrieved the admin kubeconfig.
   * `Run Command` - command execution within the cluster.
   * `Create/Update role assignment` - new permissions granted on AKS resources.
4. Click an event and review **Caller**, **Source IP**, **Time**, and **Status** for unusual principals, off-hours activity, or requests from unexpected IP addresses.
5. On the AKS cluster blade, open **Access control (IAM)** -> **Role assignments** to confirm any newly assigned roles.

## References

* <https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-kubernetes-service-contributor-role>
* <https://learn.microsoft.com/en-us/azure/aks/command-invoke>
* <https://learn.microsoft.com/en-us/azure/aks/managed-azure-ad>
* <https://microsoft.github.io/Azure-Threat-Research-Matrix/Execution/AZT301/AZT301-3/>
* <https://blog.netspi.com/attacking-azure-with-custom-script-extensions/>