GCP Service Account Key Abuse: IAM Privilege Escalation

Before the cloud logs show any attacker activity, a monitoring system flagged a problem. Identify the GCP service account whose JSON key was found exposed in a public code repository.

GCP service account JSON files contain a key_id field alongside the private key. Identify the specific key_id that was leaked and subsequently used by the attacker.

The SA key was activated from outside the corporate network. Find the external IP address from which the attacker first generated a GCP access token using the leaked credential.

After enumerating IAM state, the attacker performed a critical privileged operation on the project itself rather than on the service account. Identify the GCP Cloud Audit Log method that describes modifying a project's IAM policy.

The SetIamPolicy event added a new principal to the project. Identify the service account the attacker placed into a privileged role on the project.

After establishing elevated access, the attacker turned to data. Identify the Cloud Storage bucket they enumerated and downloaded objects from first.

The initial access in this incident did not involve a password spray, phishing email, or software exploit. It relied on a credential that was already public. Identify the MITRE ATT&CK sub-technique that describes harvesting credentials from files.