AZ_AKS_CONTRIBUTOR

Summary

Forestall ACL Alias	AZ_AKS_CONTRIBUTOR
Azure Alias	AKS Contributor / Azure Kubernetes Service Contributor
Affected Object Types	Managed Kubernetes Clusters (AKS)
Exploitation Certainty	Certain
Azure RBAC Roles	Azure Kubernetes Service Contributor Role (ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8), Azure Kubernetes Service Cluster Admin Role (0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8), Contributor (b24988ac-6180-42a0-ab88-20f7382dd24c)

Description

Grants administrative access to AKS clusters. Exploitation paths:

Method	Permission	Impact
List Admin Credentials	listClusterAdminCredential/action	Full cluster-admin kubeconfig
Run Command	runCommand/action	Execute commands in cluster
Managed Identity	Via pod/node	Pivot to Azure resources

Identification

PowerShell

# List AKS Contributor role assignments
$aksRoles = @("Azure Kubernetes Service Contributor Role", "Azure Kubernetes Service Cluster Admin Role")
Get-AzRoleAssignment | Where-Object { $aksRoles -contains $_.RoleDefinitionName } | Format-Table DisplayName, SignInName, RoleDefinitionName, Scope -AutoSize

# Check specific cluster
Get-AzRoleAssignment -Scope "/subscriptions/<SubId>/resourceGroups/<RGName>/providers/Microsoft.ContainerService/managedClusters/<ClusterName>" | Format-Table DisplayName, RoleDefinitionName, ObjectType -AutoSize

# List all AKS clusters
Get-AzAksCluster | Select-Object Name, ResourceGroupName, Location, ProvisioningState

Azure Portal

Navigate to the target AKS cluster, then Access control (IAM) -> Role assignments to view who has contributor-level access.

Exploitation

With AKS Contributor access, use either method to gain full cluster control:

• AZ_LIST_CLUSTER_ADMIN_CREDENTIALS - get cluster-admin kubeconfig (bypasses Kubernetes RBAC)

• AZ_EXECUTE_COMMAND - run commands in cluster context via Run Command API

Mitigation

1. Use Microsoft Entra integration - disable local admin accounts

2. Minimize AKS Contributor assignments - use Cluster User Role for read-only; scope to specific clusters

3. Enable Kubernetes RBAC - don't grant cluster-admin by default

4. Restrict Run Command - use Azure Policy; monitor usage

5. Secure managed identities - use workload identity; apply least privilege

Detection

Use the Azure Portal:

1. Open Azure Portal -> Monitor -> Activity log.

2. Filter by Resource type: Kubernetes Services (or scope to the target AKS cluster).

3. Review operations such as:

   • List Cluster Admin Credential - someone retrieved the admin kubeconfig.

   • Run Command - command execution within the cluster.

   • Create/Update role assignment - new permissions granted on AKS resources.

4. Click an event and review Caller, Source IP, Time, and Status for unusual principals, off-hours activity, or requests from unexpected IP addresses.

5. On the AKS cluster blade, open Access control (IAM) -> Role assignments to confirm any newly assigned roles.

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#azure-kubernetes-service-contributor-role

• https://learn.microsoft.com/en-us/azure/aks/command-invoke

• https://learn.microsoft.com/en-us/azure/aks/managed-azure-ad

• https://microsoft.github.io/Azure-Threat-Research-Matrix/Execution/AZT301/AZT301-3/

• https://blog.netspi.com/attacking-azure-with-custom-script-extensions/