services / Google Cloud / Service Account Keys

Service account keys are the credentials that service accounts use for authentication. Service accounts are Google accounts used by applications or workloads for authentication, and as result may have access to many Google services.

Service account keys are extremely sensitive since they allow users to authenticate as the service account.

iam.​serviceAccountKeys.​enable

This can allow a privilege escalation if the attacker is able to gain access to a disabled service account key.

Risks

1. Account persistence (BOOST)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links