services / Google Cloud / Compute Engine global network endpoint groups

Manage global network endpoint groups (NEGs) for Google Cloud load balancers.

Multiple organizational functions may often reside within Compute Engine. However, abuse of network-endpoint rules requires leveraging additional risks in VM / VPC configuration, such as sensitive data or access broadcast on open VPC ports.

compute.​globalNetworkEndpointGroups.​use

In combination with the ability to alter health checks, slows creation of health checks based on NEGs. Could lead to DOS if health checks are sufficiently frequent, and the referenced endpoints sufficiently expensive.

Risks

1. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links