Elastic medium stable kql

GCP IAM Service Account Impersonation Role Granted

Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.

View Source

Detection Logic

data_stream.dataset: "gcp.audit"
  and event.action: google.iam.admin.v*.SetIAMPolicy
  and event.outcome: "success"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (
      "roles/iam.serviceAccountTokenCreator" or
      "roles/iam.serviceAccountUser" or
      "roles/iam.serviceAccountOpenIdTokenCreator"
    )
  }

False Positives

  • ⚠ Infrastructure-as-code tooling (e.g. Terraform), CI/CD pipelines, and platform automation routinely grant serviceAccountUser or serviceAccountTokenCreator when wiring up workloads, deployments, or impersonation chains. Identify the expected automation principals and target service accounts and add exceptions for them.
  • ⚠ Administrators may grant impersonation roles when onboarding new applications or delegating access. Verify that the grant aligns with a known change and that both the granting principal and the added member are expected.

Field Validations

Loading…

Comments (0)

Loading comments...