services / Google Cloud / Roles

A role is a set of permissions that defines a specific level of access to resources within a single namespace. It consists of rules that specify which API operations can be performed on specific resource types. Roles are scoped to a specific Kubernetes namespace.

Roles are only definitions of permissions. A role does not take effect unless assigned to principal via a RoleBinding.

container.​roles.​escalate

Allows escalating the current or other users' permissions by creating a new Role or updating an existing Role. Also requires the `roles.create` or `roles.update` permission.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links