services / Google Cloud / Cloud KMS EKM Connections

An EKM connection organizes VPC connections to your on-premises external key managers in a specific Google Cloud location. An EKM connection allows you to connect to and use keys from an external key manager over a VPC network

cloudkms.​ekmConnections.​setIamPolicy

Risks

1. Policy destruction (CRITICAL)
2. Privilege escalation (CRITICAL)
3. Denial-of-access (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links