<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-gcp-iam-permissions
description: >-
  Audit Google Cloud Platform IAM permissions to detect overprivileged service accounts,
  excessive primitive roles, unused permissions, and cross-project access risks using
  IAM Recommender and Policy Analyzer.
domain: cybersecurity
subdomain: cloud-security
tags:
  - gcp
  - iam
  - service-accounts
  - policy-analyzer
  - iam-recommender
  - least-privilege
  - primitive-roles
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Auditing GCP IAM Permissions

## Overview

GCP IAM misconfigurations — excessive primitive roles (Owner/Editor), overprivileged
service accounts, and stale permissions — expand blast radius and enable lateral
movement. This skill uses IAM Recommender, Policy Analyzer, and manual CLI auditing
to identify overprivileged principals and enforce least privilege across GCP projects
and organizations.

Mode: `[MODE: BLUE]` — IAM posture assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| `gcloud` CLI authenticated with sufficient privileges | Required |
| Roles | `roles/iam.securityReviewer`, `roles/recommender.iamViewer` |
| IAM Recommender API and Policy Analyzer API enabled | Required |
| Python 3.10+ with `google-cloud-iam`, `google-cloud-recommender` | Required |

## Key Concepts

### Primitive Role Detection

Primitive roles (Owner, Editor, Viewer) grant broad access and should be replaced
with predefined or custom roles:

```bash
# Find all principals with primitive roles
gcloud projects get-iam-policy $PROJECT_ID --format=json | \
  jq '.bindings[] | select(.role | test("roles/(owner|editor|viewer)")) |
    {role: .role, members: .members}'

# Count primitive role assignments across org
for project in $(gcloud projects list --format="value(projectId)"); do
  COUNT=$(gcloud projects get-iam-policy "$project" --format=json 2>/dev/null | \
    jq '[.bindings[] | select(.role | test("roles/(owner|editor)")) | .members[]] | length')
  [ "$COUNT" -gt 0 ] && echo "$project: $COUNT owner/editor assignments"
done
```

### Service Account Audit

```bash
# List all service accounts
gcloud iam service-accounts list --project=$PROJECT_ID \
  --format="table(email,displayName,disabled)"

# Find service accounts with key older than 90 days
gcloud iam service-accounts keys list --iam-account=$SA_EMAIL \
  --format="json" | jq '.[] | select(.keyType=="USER_MANAGED") |
    {keyId: .name, created: .validAfterTime, expires: .validBeforeTime}'

# Check service account IAM bindings
gcloud projects get-iam-policy $PROJECT_ID --format=json | \
  jq '.bindings[] | select(.members[] | contains("serviceAccount:")) |
    {role: .role, serviceAccounts: [.members[] | select(contains("serviceAccount:"))]}'

# Find service accounts with admin/owner roles
gcloud projects get-iam-policy $PROJECT_ID --format=json | \
  jq '.bindings[] | select(.role | test("admin|owner|editor")) |
    select(.members[] | contains("serviceAccount:")) |
    {role: .role, accounts: [.members[] | select(contains("serviceAccount:"))]}'
```

### IAM Recommender

```bash
# Get IAM recommendations for a project
gcloud recommender recommendations list \
  --project=$PROJECT_ID \
  --location=global \
  --recommender=google.iam.policy.Recommender \
  --format="table(name,recommenderSubtype,priority,stateInfo.state)"

# Get detailed recommendation
gcloud recommender recommendations describe $RECOMMENDATION_ID \
  --project=$PROJECT_ID \
  --location=global \
  --recommender=google.iam.policy.Recommender

# List IAM insights (unused permissions)
gcloud recommender insights list \
  --project=$PROJECT_ID \
  --location=global \
  --insight-type=google.iam.policy.Insight \
  --format="table(name,insightSubtype,severity,stateInfo.state)"
```

### Policy Analyzer

```bash
# Analyze who can access a specific resource
gcloud asset analyze-iam-policy \
  --organization=$ORG_ID \
  --resource-selector="//cloudresourcemanager.googleapis.com/projects/$PROJECT_ID" \
  --format=json

# Find all principals who can create VMs
gcloud asset analyze-iam-policy \
  --organization=$ORG_ID \
  --permissions="compute.instances.create" \
  --format=json
```

## Workflow

### Step 1: Enumerate All Projects

```bash
gcloud projects list --format="table(projectId,name,projectNumber)"
```

### Step 2: Run IAM Audit Across Projects

```bash
node scripts/agent.js --project-id $PROJECT_ID --output /tmp/gcp_iam_audit.json
```

## Detection

```yaml
title: Auditing Gcp Iam Permissions Detection
id: fc830afc-dfd3-40ca-b8dc-c6f671a56e14
status: experimental
description: Detects suspicious activity related to auditing gcp iam permissions techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Gcp Iam Permissions Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.004 |

## Verification

- [ ] No primitive roles (Owner/Editor) on service accounts
- [ ] All service account keys rotated within 90 days
- [ ] IAM Recommender suggestions reviewed and applied
- [ ] No unused service accounts (>90 days inactive)
- [ ] Organization policy constraints enforce domain-restricted sharing
- [ ] Workload identity federation preferred over service account keys
- [ ] Custom roles replace overly broad predefined roles where needed

## References

- [CIS GCP Foundations Benchmark — IAM](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)
- [GCP IAM Best Practices](https://cloud.google.com/iam/docs/using-iam-securely)
- [MITRE ATT&CK T1078.004 — Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
- [GCP IAM Recommender](https://cloud.google.com/iam/docs/recommender-overview)
