Loading

GCP IAM Service Account Impersonation Role Granted

Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.

Rule type: new_terms
Rule indices:

  • logs-gcp.audit-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Data Source: GCP
  • Data Source: GCP Audit Logs
  • Data Source: Google Cloud Platform
  • Use Case: Identity and Access Audit
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Tactic: Privilege Escalation
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic
  • Aryu Zaw

Rule license: Elastic License v2

Granting an impersonation role on a service account lets the bound member obtain that service account's credentials without creating a long-lived key. roles/iam.serviceAccountTokenCreator and roles/iam.serviceAccountOpenIdTokenCreator allow minting OAuth2 access tokens and OpenID Connect identity tokens, while roles/iam.serviceAccountUser allows the member to attach (actAs) the service account to new resources. Adversaries abuse these grants to pivot to a higher-privileged identity, escalate privileges, and persist in a way that is unaffected by key rotation or password resets.

  • Identify the granting principal via user.email and user.id and confirm whether that identity is expected to modify IAM policy on service accounts.
  • Review the target service account in gcp.audit.resource_name and determine the permissions it holds. Impersonating a service account with broad project or organization roles represents a significant escalation.
  • Inspect the granted binding in gcp.audit.request / gcp.audit.response to identify the member that was added (user:, serviceAccount:, group:, or an external domain). External or newly created members are higher risk.
  • Examine gcp.audit.request_metadata.caller_ip and gcp.audit.request_metadata.caller_supplied_user_agent to assess whether the change originated from an expected location or tool.
  • Correlate with recent activity by the granting principal, such as service account key creation, custom role creation, or GenerateAccessToken / GenerateIdToken calls that use the newly granted impersonation rights.
  • Terraform, Deployment Manager, and CI/CD service accounts commonly grant serviceAccountUser and serviceAccountTokenCreator as part of normal provisioning. Baseline these principals and exclude them with exceptions.
  • One-time grants during application onboarding or delegation may be legitimate. Validate against change management before escalating.
  • If the grant is unauthorized, remove the impersonation binding from the service account's IAM policy.
  • Revoke any access or identity tokens issued for the impacted service account and review its recent activity for abuse.
  • Investigate the granting principal for compromise, rotate its credentials if necessary, and review what other IAM changes it has made.
  • Restrict who can set IAM policy on service accounts and require justification or approval for impersonation grants.
data_stream.dataset: "gcp.audit"
  and event.action: google.iam.admin.v*.SetIAMPolicy
  and event.outcome: "success"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (
      "roles/iam.serviceAccountTokenCreator" or
      "roles/iam.serviceAccountUser" or
      "roles/iam.serviceAccountOpenIdTokenCreator"
    )
  }

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK