storage.setIamPermissions
storage.setIamPermissions
Event
Sets the IAM policy on a Cloud Storage bucket or object, controlling which principals can access it.
Security Context
- Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
- Escalating privileges enables adversaries to access sensitive resources and perform administrative actions beyond their initial access level.
- Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
Log Source
Cloud Audit Logs
Sample Event
Adversarial. Draco grants roles/storage.objectViewer on the fantasticlogs-demiguise-models bucket (holds proprietary trained ML model artifacts) to allUsers — making the entire bucket world-readable over the public internet. From this point on, anyone with the bucket name can curl https://storage.googleapis.com/fantasticlogs-demiguise-models/<object> and download model files. The change generates no further GCS audit events for the resulting anonymous reads (anonymous access is below the audit threshold by default), so the exfiltration window is invisible until the public binding is rolled back. Note: GCS uses methodName=storage.setIamPermissions (not setIamPolicy) and emits the change in serviceData.policyDelta rather than request/response.
{ "protoPayload": { "@type": "type.googleapis.com/google.cloud.audit.AuditLog", "authenticationInfo": { "principalEmail": "draco@fantasticlogs.cloud" }, "requestMetadata": { "callerIp": "203.0.113.66", "callerSuppliedUserAgent": "google-cloud-sdk gcloud/465.0.0 command/gcloud.storage.buckets.add-iam-policy-binding invocation-id/90000000000000000000010000001001 environment/None environment-version/None client-os/LINUX client-os-ver/(5,15,0) client-pltf-arch/x86_64 interactive/False from-script/False python/3.11.6 term/xterm-256color (Linux 5.15.0-1052-aws),gzip(gfe)", "requestAttributes": { "time": "2026-04-15T17:25:47.221987654Z", "auth": {} }, "destinationAttributes": {} }, "serviceName": "storage.googleapis.com", "methodName": "storage.setIamPermissions", "authorizationInfo": [ { "resource": "projects/_/buckets/fantasticlogs-demiguise-models", "permission": "storage.buckets.setIamPolicy", "granted": true, "resourceAttributes": { "service": "storage.googleapis.com", "name": "projects/_/buckets/fantasticlogs-demiguise-models", "type": "storage.googleapis.com/Bucket" } } ], "resourceName": "projects/_/buckets/fantasticlogs-demiguise-models", "serviceData": { "@type": "type.googleapis.com/google.iam.v1.logging.AuditData", "policyDelta": { "bindingDeltas": [ { "action": "ADD", "role": "roles/storage.objectViewer", "member": "allUsers" } ] } }, "resourceLocation": { "currentLocations": [ "us-central1" ] } }, "insertId": "evt010000001001", "resource": { "type": "gcs_bucket", "labels": { "project_id": "fantasticlogs-prod", "bucket_name": "fantasticlogs-demiguise-models", "location": "us-central1" } }, "timestamp": "2026-04-15T17:25:47.123456789Z", "severity": "NOTICE", "logName": "projects/fantasticlogs-prod/logs/cloudaudit.googleapis.com%2Factivity", "receiveTimestamp": "2026-04-15T17:25:47.567890123Z"}MITRE ATT&CK Mapping
Tactics: Privilege Escalation Collection
- T1098.003 — Additional Cloud Roles — An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permi...
- T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage.