Azure Containers built-in role
Azure Kubernetes Service Contributor Role
Creates and manages AKS managed-cluster resources. Its managedClusters wildcard also covers clusterUser and clusterAdmin credential retrieval, access-profile credential retrieval, and AKS Run Command. It has no Kubernetes API DataActions, but admin credentials and Run Command can operate the Kubernetes API outside this role definition's DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: ed7f3fbd-7b88-4dd4-9017-9adb7ce333f8
Control-plane actions (9)
Microsoft.Authorization/*/readMicrosoft.ContainerService/locations/*Microsoft.ContainerService/managedClusters/*Microsoft.ContainerService/managedclustersnapshots/*Microsoft.ContainerService/snapshots/*Microsoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.ContainerService/deploymentSafeguards/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual AKS cluster when possible. Resource-group, subscription, or management-group assignments are inherited by all AKS resources below the scope and permit lifecycle changes across those clusters.
Common use cases (1)
- Allow a tightly controlled AKS platform operator to manage cluster lifecycle and, when required, retrieve user or administrator kubeconfig credentials or invoke an approved kubectl or Helm command through AKS Run Command.
Prerequisites (2)
- Define the cluster lifecycle responsibility, network, identity, node pools, upgrade policy, and authorization model before granting management access.
- Grant separate roles on connected registries, networks, managed identities, monitoring workspaces, Key Vaults, and Kubernetes API resources as required.
Best practices (2)
- Assign to a small platform group on dedicated cluster resource groups and use Kubernetes RBAC roles for application teams.
- Use policy, maintenance windows, tested upgrades, and audit logs for cluster changes, credential retrieval, and Run Command; do not grant this role merely to deploy workloads.
Security considerations (3)
- Cluster lifecycle and configuration changes can affect every workload, node, network path, identity, and availability boundary in the cluster.
- The role can retrieve clusterAdmin credentials, which provide administrator access, and Run Command can remotely execute kubectl or Helm and apply attached manifests through an in-cluster command pod.
- The absence of Kubernetes DataActions in the definition is not a workload-access boundary because the included credential and command paths can reach the Kubernetes API.
Assignment guidance
Assign Azure Kubernetes Service Contributor directly on the managed cluster or dedicated AKS resource group only to the platform team that owns lifecycle, credential retrieval, and Run Command. Give application teams namespace-scoped Kubernetes roles and use narrower credential roles when lifecycle management is unnecessary.
Related roles (2)
- Azure Kubernetes Service Cluster User Role: Narrower clusterUser kubeconfig retrieval without cluster lifecycle, clusterAdmin credential, or Run Command authority.
- Azure Kubernetes Service RBAC Admin: Kubernetes API administration within a namespace, separate from Azure cluster management.
Common questions
When should I assign the Azure Kubernetes Service Contributor Role Azure role?
Assign Azure Kubernetes Service Contributor Role when you need to: Allow a tightly controlled AKS platform operator to manage cluster lifecycle and, when required, retrieve user or administrator kubeconfig credentials or invoke an approved kubectl or Helm command through AKS Run Command.. Practical scope: Assign on the individual AKS cluster when possible. Resource-group, subscription, or management-group assignments are inherited by all AKS resources below the scope and permit lifecycle changes across those clusters.
What permissions does the Azure Kubernetes Service Contributor Role Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.ContainerService/locations/*; Microsoft.ContainerService/managedClusters/*; Microsoft.ContainerService/managedclustersnapshots/*; Microsoft.ContainerService/snapshots/*; and Microsoft.Insights/alertRules/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Service Contributor Role Azure role?
Key considerations when assigning Azure Kubernetes Service Contributor Role: Cluster lifecycle and configuration changes can affect every workload, node, network path, identity, and availability boundary in the cluster.; The role can retrieve clusterAdmin credentials, which provide administrator access, and Run Command can remotely execute kubectl or Helm and apply attached manifests through an in-cluster command pod.; and The absence of Kubernetes DataActions in the definition is not a workload-access boundary because the included credential and command paths can reach the Kubernetes API.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC to define access to the Kubernetes configuration file in AKS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Access a private AKS cluster using Command Invoke or Run Command →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Use Azure RBAC for Kubernetes authorization →
Supports: Description, Practical scope, Related roles. Retrieved 2026-07-17.