An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)
 
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised.  

Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based  role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
Additional Container Cluster Roles
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1098/006  external_id: T1098.006     source_name: AWS EKS IAM Roles for Service Accounts  description: Amazon Web Services. (n.d.). IAM roles for service accounts. Retrieved July 14, 2023.  url: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html     source_name: Google Cloud Kubernetes IAM  description: Google Cloud. (n.d.). Create IAM policies. Retrieved July 14, 2023.  url: https://cloud.google.com/kubernetes-engine/docs/how-to/iam     source_name: Kuberentes ABAC  description: Kuberenets. (n.d.). Using ABAC Authorization. Retrieved July 14, 2023.  url: https://kubernetes.io/docs/reference/access-authn-authz/abac/     source_name: Kubernetes RBAC  description: Kubernetes. (n.d.). Role Based Access Control Good Practices. Retrieved March 8, 2023.  url: https://kubernetes.io/docs/concepts/security/rbac-good-practices/     source_name: Aquasec Kubernetes Attack 2023  description: Michael Katchinskiy, Assaf Morag. (2023, April 21). First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters. Retrieved July 14, 2023.  url: https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters     source_name: Microsoft Azure Kubernetes Service Service Accounts  description: Microsoft Azure. (2023, April 28). Access and identity options for Azure Kubernetes Service (AKS). Retrieved July 14, 2023.  url: https://learn.microsoft.com/en-us/azure/aks/concepts-identity     