services / Google Cloud / Compute Engine instance templates

Templates used to create managed instance groups and individual VM instances with a consistent configuration.

compute.​instanceTemplates.​get

Allows access to the template's configuration, including metadata (which may embed startup-script credentials or other secrets, the same way an instance's own metadata can), the network configuration, and the service account/scopes any instance created from the template would be bound to.

Risks

1. Account discovery (LOW)
2. Network discovery (LOW)
3. Policy discovery (LOW)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links