GKE Forbidden Creation Request

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GKE Forbidden Creation Request

Detects denied GKE API create requests from non-control-plane identities. Failed creates can indicate RBAC probing, stolen credentials with insufficient privileges, or attempts to deploy unauthorized workloads.

Rule type: query

Rule indices:

logs-gcp.audit-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: Kubernetes
Data Source: GCP
Data Source: Google Cloud Platform
Use Case: Threat Detection
Tactic: Execution
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GKE Forbidden Creation Request

Denied creates outside GKE system identities often reflect reconnaissance or misconfigured automation with stolen tokens.

Investigation steps

Review client.user.email, event.action, gcp.audit.resource_name, source.ip, user_agent.original, and gcp.audit.status.message.
Determine whether the identity should exist and whether the target resource is sensitive (pods, secrets, RBAC).
Correlate with later successful creates or RBAC changes from the same actor.

False positives

New deployments where RoleBindings lag the workload; exclude approved CI service accounts after review.

Setup

edit

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

Rule query

edit

data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
event.action:*.create and
gcp.audit.status.message:(*forbidden* or *Unauthorized*) and
not client.user.email:(
  "system:apiserver" or system\:kube-* or "system:cloud-controller-manager" or system\:gke-* or
  system\:node\:* or system\:serviceaccount\:kube-system\:* or system\:serviceaccount\:gke-managed* or
  "kubelet-bootstrap" or "kubelet-nodepool-bootstrap" or "gcp:kube-bootstrap"
) and
not user_agent.original:(*kubernetes/$Format)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/

« GKE Anonymous Pod Create/Update/Patch GKE Forbidden Request from Unusual User Agent »