GCP Service Account Impersonation Role Grant Detection

Adversaries with sufficient GCP administrative privileges can establish durable, key-less persistence by granting themselves or an attacker-controlled principal specific IAM roles on a target service account. The roles roles/iam.serviceAccountTokenCreator, roles/iam.serviceAccountUser, and roles/iam.serviceAccountOpenIdTokenCreator allow a principal to mint OAuth2 access tokens, generate OpenID Connect identity tokens, or attach (actAs) the target service account to new cloud resources. Because these roles leverage GCP's native IAM trust relationship rather than long-lived static service account keys, the resulting access is unaffected by traditional credential rotation or password reset procedures. This technique is commonly used to pivot from a compromised low-privileged identity to a higher-privileged service account with broader project or organization-level permissions. Defenders should monitor for unexpected SetIamPolicy operations, particularly when the principal performing the grant has not historically performed such actions.

Impact

Successful exploitation allows an adversary to maintain long-term access to a GCP environment regardless of security team efforts to rotate credentials. It facilitates significant privilege escalation if the target service account possesses broad IAM permissions. In enterprise environments, this can lead to unauthorized data access, infrastructure manipulation, and cross-project movement within the GCP organization.

Recommendation

• Deploy detection rules to monitor SetIamPolicy operations that add impersonation roles to service accounts.
• Baseline administrative and CI/CD service accounts (such as Terraform or Jenkins) that legitimately perform IAM modifications to reduce false positives.
• Restrict the ability to set IAM policies on service accounts and implement a peer-review or justification-based approval process for IAM changes.
• Review existing IAM bindings for unauthorized principals or external accounts that have been granted impersonation rights.