Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto re...
View on MITRE ATT&CK →Generates a short-lived OAuth2 access token for a service account, used for impersonation or workload federation. Recorded on the Data Access audit-log stream (not enabled by default for IAM); see also iam.serviceAccounts.getAccessToken.
Records use of the actAs permission, where one identity impersonates and acts on behalf of a GCP service account.
Records a token exchange where a service account implicitly delegates its authority to another identity.
Signs a JWT on behalf of a service account via the IAM Credentials API, used for authentication or token exchange.
