services / Google Cloud / Service Account Keys

Service account keys are the credentials that service accounts use for authentication. Service accounts are Google accounts used by applications or workloads for authentication, and as result may have access to many Google services.

Service account keys are extremely sensitive since they allow users to authenticate as the service account.

iam.​serviceAccountKeys.​create

Risks

1. Account takeover (CRITICAL)
2. Account persistence (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links