services / Google Cloud / Compute Engine managed instances

Create and alter managed instances.

Allows access to general core VM infrastructure, which can support a broad array of organizational functions. Note that the terms "instance" and "VM" are interchangeable within the compute engine documentation, although may have semantic differences within these privileges.

compute.​instances.​setServiceAccount

Set a service account removes any existing service account access from the machine, preventing any requests to other resources that rely on that account. When the newly attached service account is already compromised, can allow lateral escalation to the instance.

Risks

1. Infrastructure destruction (HIGH)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links