services / Google Cloud / Compute Engine virtual-private-cloud networks

Allows management of virtual-private-cloud networks (VPCs). A VPC is a logically isolated network, allowing communication of instances within the network, isolation of instances from entities outside the network, and policy-based network controls between instances within the network, and entities outside of it.

VPCs are generally highly sensitive. Alterations to, or destruction of, the VPC can prevent instances from serving applications, processing data, and the like. Obtaining access to the VPC can allow access to attached instance services. Finally, altering a VPC can allow data to be extracted from an otherwise compromised instance.

compute.​networks.​setFirewallPolicy

When used to allow additional access, can either allow access to compute network endpoints, or allow outbound exfiltration of data from otherwise compromised instances. When used to remove access, can prevent service operation or account access.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-service (HIGH)
3. Network movement (BOOST)
4. Denial-of-access (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links