services / Google Cloud / Google Cloud SQL

SSL client certificates for connecting to a Cloud SQL instance. Each instance can have 10 client certificates.

Cloud SQL is used to store and serve sensitive and application-critical data. Breach of a cloud SQL database can lead to exfiltration of highly sensitive data, or interruption of mission-critical applications.

cloudsql.​sslCerts.​create

This permission allows creating a client SSL certificate for the instance, which allows the user to establish a connection to the instance. Note that authentication into the database is still separate, so this does not provide access to data.

Risks

1. Network movement (BOOST)
2. Infrastructure consumption (LOW)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links