​
Event Information

  • The google.iam.admin.v1.CreateServiceAccountKey event in GCP for GCPIAM refers to the creation of a new service account key in the Google Cloud Identity and Access Management (IAM) service.
  • This event indicates that a new key has been generated for a specific service account, which can be used for authentication and authorization purposes within GCP.
  • The event provides information about the service account, such as its unique identifier, email address, and the project in which it was created.

​
Examples

  1. Unauthorized access: If security is impacted with google.iam.admin.v1.CreateServiceAccountKey in GCP for GCPIAM, it could potentially lead to unauthorized access to service account keys. This means that an attacker could create new service account keys without proper authorization, allowing them to gain access to sensitive resources and perform malicious actions.

  2. Privilege escalation: Another security impact could be privilege escalation. By creating service account keys without proper authorization, an attacker could potentially elevate their privileges and gain access to resources and actions that they are not supposed to have. This could lead to unauthorized modifications, data breaches, or other malicious activities.

  3. Lack of accountability: If security is impacted with google.iam.admin.v1.CreateServiceAccountKey in GCP for GCPIAM, it could result in a lack of accountability. Without proper controls and authorization, it becomes difficult to track and monitor the creation of service account keys. This can make it challenging to identify and attribute any unauthorized or malicious activities back to the responsible party, hindering incident response and forensic investigations.

​
Remediation

​
Using Console

  1. Example 1: Ensure that all users have multi-factor authentication (MFA) enabled for their GCP accounts.

    • Step 1: Log in to the GCP Console using your administrator account.
    • Step 2: Navigate to the IAM & Admin page by clicking on the “IAM & Admin” option in the left-hand menu.
    • Step 3: In the IAM & Admin page, click on the “IAM” tab.
    • Step 4: Select the user for whom you want to enable MFA.
    • Step 5: Click on the “Edit” button next to the user’s name.
    • Step 6: In the “Edit permissions” dialog, scroll down to the “Two-step verification” section.
    • Step 7: Click on the “Enable” button next to “Two-step verification”.
    • Step 8: Follow the on-screen instructions to set up MFA for the user.

  2. Example 2: Ensure that all GCP service accounts are regularly rotated.

    • Step 1: Log in to the GCP Console using your administrator account.
    • Step 2: Navigate to the IAM & Admin page by clicking on the “IAM & Admin” option in the left-hand menu.
    • Step 3: In the IAM & Admin page, click on the “Service accounts” tab.
    • Step 4: Select the service account for which you want to rotate the keys.
    • Step 5: Click on the “Keys” tab.
    • Step 6: Click on the “Add key” button and select the type of key you want to add (e.g., JSON or P12).
    • Step 7: Follow the on-screen instructions to generate and download the new key.
    • Step 8: Once the new key is downloaded, delete the old key from the list of keys.

  3. Example 3: Ensure that GCP Cloud Storage buckets are not publicly accessible.

    • Step 1: Log in to the GCP Console using your administrator account.
    • Step 2: Navigate to the Cloud Storage page by clicking on the “Storage” option in the left-hand menu.
    • Step 3: In the Cloud Storage page, select the bucket for which you want to change the access permissions.
    • Step 4: Click on the “Permissions” tab.
    • Step 5: In the “Permissions” tab, review the list of users and groups with access to the bucket.
    • Step 6: Remove any entries that have the “allUsers” or “allAuthenticatedUsers” as members.
    • Step 7: Click on the “Add members” button to grant access to specific users or groups, if necessary.
    • Step 8: Save the changes to update the access permissions for the bucket.

​
Using CLI

To remediate the issues related to GCP GCPIAM using GCP CLI, you can follow these steps:

  1. Enable multi-factor authentication (MFA) for IAM users:

    • Use the gcloud command to enable MFA for a specific user: 
      gcloud auth login
gcloud auth application-default login
    • Follow the prompts to complete the MFA setup.

  2. Implement least privilege access control:

    • Use the gcloud command to create a custom IAM role with the necessary permissions: 
      gcloud iam roles create <role_name> --project=<project_id> --title="<role_title>" --description="<role_description>" --permissions=<comma_separated_permissions>
    • Assign the custom IAM role to the appropriate users or service accounts: 
      gcloud projects add-iam-policy-binding <project_id> --member=<member> --role=<role_name>

  3. Regularly review and rotate access keys:

    • Use the gcloud command to list all the service accounts in a project: 
      gcloud iam service-accounts list --project=<project_id>
    • For each service account, use the gcloud command to create a new key and delete the old key: 
      gcloud iam service-accounts keys create <new_key_file> --iam-account=<service_account_email> --project=<project_id>
gcloud iam service-accounts keys delete <old_key_file> --iam-account=<service_account_email> --project=<project_id>

Please note that the actual commands may vary depending on your specific requirements and configurations. Make sure to replace the placeholders (<role_name>, <project_id>, <member>, <new_key_file>, <old_key_file>, etc.) with the appropriate values.

​
Using Python

To remediate GCP GCPIAM issues using Python, you can utilize the Google Cloud Identity and Access Management (GCPIAM) API. Here are three examples of how you can use Python to address these issues:

  1. Granting IAM Roles:

    • Use the google-cloud-iam library to create a service account and grant it the necessary IAM roles.
    • Example Python script: 
      from google.cloud import iam

client = iam.IAMClient()
policy = client.get_policy(request={"resource": "projects/PROJECT_ID"})
policy.bindings.add(role="roles/ROLE_NAME", members=["user:USER_EMAIL"])
client.set_policy(request={"resource": "projects/PROJECT_ID", "policy": policy})

  2. Enforcing IAM Policies:

    • Use the google-cloud-asset library to retrieve the current IAM policies and enforce the desired policies.
    • Example Python script: 
      from google.cloud import asset

client = asset.AssetServiceClient()
response = client.export_assets(request={"parent": "projects/PROJECT_ID", "output_config": {"gcs_destination": {"uri": "gs://BUCKET_NAME/exported_assets"}}})

  3. Monitoring IAM Changes:

    • Use the google-cloud-logging library to set up a log sink and receive notifications for IAM changes.
    • Example Python script: 
      from google.cloud import logging_v2

client = logging_v2.LoggingServiceV2Client()
response = client.create_sink(request={"parent": "projects/PROJECT_ID", "sink": {"name": "SINK_NAME", "destination": "pubsub.googleapis.com/projects/PROJECT_ID/topics/TOPIC_NAME"}})

Please note that you need to replace PROJECT_ID, ROLE_NAME, USER_EMAIL, BUCKET_NAME, SINK_NAME, and TOPIC_NAME with the appropriate values specific to your GCP environment.