GCP add-iam-policy-binding
Adds an IAM policy binding to a GCP resource, granting a member (user, group, or service account) a specified role.
All events with tag GCP.
Adds an IAM policy binding to a GCP resource, granting a member (user, group, or service account) a specified role.
Creates and submits a BigQuery job (query, load, export, or copy) that accesses or transforms data in BigQuery datasets.
Exports data from a Cloud SQL instance to a Cloud Storage bucket.
Sets the IAM policy on a Compute Engine persistent disk, controlling which principals have access to it.
Deletes a firewall rule from a GCP VPC network.
Modifies an existing firewall rule in a GCP VPC network.
Adds an external IP access configuration to an instance, exposing an internal resource to the internet.
Sets or updates instance-level metadata on a Compute Engine VM, which can include SSH keys or startup scripts.
Changes the service account attached to a Compute Engine instance, enabling privilege escalation via service account swap.
Sets project-wide Compute Engine metadata, applied to all instances and commonly used to manage SSH keys.
Creates a custom IAM role in GCP with a specified set of granular permissions.
Re-enables a previously disabled GCP service account, restoring its ability to authenticate and make API calls.
Generates a short-lived OAuth2 access token for a service account, used for impersonation or workload federation. This is the admin activity audit log format; see also iam.serviceAccounts.getAccessToken for the data access format.
Mutes Security Command Center findings, suppressing security alerts from visibility.
Creates a new key for a GCP service account, producing a JSON credentials file for programmatic authentication. This is the admin activity audit log format; see also iam.serviceAccountKeys.create for the data access format.
Deletes a service account, disrupting workloads and applications that depend on it for authentication.
Deletes a service account key, potentially removing evidence of attacker-created credentials.
Replaces the complete IAM policy for a GCP resource, controlling access for all principals.
Uploads an external key to a service account, enabling persistent access that survives credential rotation.
Deletes log entries from Cloud Logging, destroying forensic evidence of attacker activity.
Modifies a logging exclusion filter to silently drop specific log entries, hiding ongoing attacker activity.
Establishes a serial console connection to a Compute Engine VM, providing low-level instance access.
Updates an existing custom IAM role, modifying its set of permitted permissions.
Creates a new key for a GCP service account, generating credentials for external services to authenticate as the account. This is the data access audit log format; see also google.iam.admin.v1.CreateServiceAccountKey for the admin activity format.
Records a token exchange where a service account implicitly delegates its authority to another identity.
Records use of the actAs permission, where one identity impersonates and acts on behalf of a GCP service account.
Generates an OAuth2 access token for a service account via the IAM Credentials API, enabling service account impersonation. This is the data access audit log format; see also generateAccessToken for the admin activity format.
Signs a JWT on behalf of a service account via the IAM Credentials API, used for authentication or token exchange.
Creates a log exclusion rule in Cloud Logging that prevents matching log entries from being ingested.
Deletes a Cloud Logging sink that was routing log entries to a destination such as Cloud Storage or BigQuery.
Modifies a Cloud Logging sink's configuration, such as its destination or log filter criteria.
Permanently deletes a secret and all of its versions from GCP Secret Manager.
Retrieves the plaintext value of a specific secret version from GCP Secret Manager.
Permanently destroys a specific version of a secret in GCP Secret Manager, making its data irrecoverable.
Updates the settings or configuration of Google Security Command Center for the organization or project.
Deletes a finding source from Google Security Command Center.
Permanently deletes a GCP Cloud Storage bucket; the bucket must be empty before deletion.
Creates HMAC keys for S3-compatible access to Cloud Storage, providing a persistent access mechanism often missed by defenders.
Deletes objects from Cloud Storage, used in data destruction or anti-forensics operations.
Sets the IAM policy on a Cloud Storage bucket or object, controlling which principals can access it.
Imports an SSH public key into a user's GCP OS Login profile, enabling SSH access to Compute Engine instances.
Updates an existing SSH public key in a user's GCP OS Login profile.