« Microsoft Graph Application Directory Reconnaissance with Denied Requests First Time GCP Vertex AI Inference by Caller from Source ASN »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.37

GCP Vertex AI Role Granted to Principal

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GCP Vertex AI Role Granted to Principal

edit

Identifies an IAM policy change on a Google Cloud project, folder, or organization that grants a Vertex AI role (roles/aiplatform.*) to a principal. Vertex AI roles control who can invoke models, deploy endpoints, run agents, and read prompt and training data. An adversary who has gained IAM administration rights can grant a Vertex AI role to an identity they control to keep model access after the original foothold is removed, or to run LLMjacking workloads under the victim’s billing. Google-managed service agent roles are excluded because Google grants them automatically when the API is enabled.

Rule type: query

Rule indices:

  • logs-gcp.audit-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: GenAI
  • Domain: Identity
  • Data Source: GCP
  • Data Source: Google Cloud Platform
  • Platform: GCP
  • Service: GCP Vertex AI
  • Use Case: Identity and Access Audit
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Tactic: Privilege Escalation
  • Threat: Unauthorized AI Usage
  • Mitre Atlas: AML.T0012
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GCP Vertex AI Role Granted to Principal

A Google Cloud IAM policy change added a binding for a Vertex AI role (roles/aiplatform.*). Roles such as roles/aiplatform.admin and roles/aiplatform.user allow the member to call models, manage endpoints and agents, and access prompt and training data in the project.

Possible investigation steps

  • Identify the caller that changed the policy from client.user.email, and review source.ip and user_agent.original for the change.
  • Review gcp.audit.service_data.policy_delta.binding_deltas for the role and member that were added. Members outside the organization’s domain, newly created service accounts, and allUsers or allAuthenticatedUsers are the most concerning.
  • Check gcp.audit.resource_name to see whether the grant was made at the project, folder, or organization level. Grants above the project level reach every project underneath.
  • Look for follow-on activity by the new member in Vertex AI audit logs, such as inference calls from new networks, endpoint deployment, or agent creation.
  • Review other recent IAM changes by the same caller, especially service account key creation and grants of IAM admin roles.

False positive analysis

  • Approved access requests for ML and data science teams. Confirm with the request owner.
  • IAM automation that reapplies bindings. Exclude those service accounts by email.

Response and remediation

  • If the grant is not authorized, remove the binding and review what the member accessed since the grant.
  • Investigate how the caller obtained IAM administration rights, rotate its credentials, and review its other changes.
  • Restrict resourcemanager.projects.setIamPolicy to a small set of administrators and consider an Organization Policy that limits allowed member domains.

Setup

edit

Setup

This rule requires Google Cloud Audit Logs ingested via the GCP integration (gcp.audit data stream). IAM policy changes are Admin Activity audit logs and are always logged.

Rule query

edit
data_stream.dataset: "gcp.audit"
  and event.action: (
    "SetIamPolicy" or
    google.cloud.resourcemanager.v*.Folders.SetIamPolicy or
    google.cloud.resourcemanager.v*.Organizations.SetIamPolicy or
    google.cloud.resourcemanager.v*.Projects.SetIamPolicy
  )
  and not event.outcome: "failure"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (roles/aiplatform.* and not (*ServiceAgent or *serviceAgent))
  }

Framework: MITRE ATT&CKTM

« Microsoft Graph Application Directory Reconnaissance with Denied Requests First Time GCP Vertex AI Inference by Caller from Source ASN »