Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Overview

The default Compute Engine service account was used to set the IAM policy for a Cloud Run service. This is a potential post exploit action when a Compute Engine token is compromised from a serverless service.

How to respond

To respond to this finding, do the following:

1. Review the audit logs in Cloud Logging to determine if this was expected activity by the principal.
2. Determine whether there are other signs of malicious activity by the principal in the logs.

What's next

• Learn how to work with threat findings in Security Command Center.
• Refer to the Threat findings index.
• Learn how to review a finding through the Google Cloud console.
• Learn about the services that generate threat findings.