GCP IAM Service Account Impersonation Role Granted

Last updated 2 months ago on 2026-05-30

Created 2 months ago on 2026-05-30

About

Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.

Tags

Domain: CloudData Source: GCPData Source: GCP Audit LogsData Source: Google Cloud PlatformUse Case: Identity and Access AuditUse Case: Threat DetectionTactic: PersistenceTactic: Privilege EscalationLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples

Infrastructure-as-code tooling (e.g. Terraform), CI/CD pipelines, and platform automation routinely grant serviceAccountUser or serviceAccountTokenCreator when wiring up workloads, deployments, or impersonation chains. Identify the expected automation principals and target service accounts and add exceptions for them. Administrators may grant impersonation roles when onboarding new applications or delegating access. Verify that the grant aligns with a known change and that both the granting principal and the added member are expected.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-gcp.audit-*
Related Integrations: gcp(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "gcp.audit"
  and event.action: google.iam.admin.v*.SetIAMPolicy
  and event.outcome: "success"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (
      "roles/iam.serviceAccountTokenCreator" or
      "roles/iam.serviceAccountUser" or
      "roles/iam.serviceAccountOpenIdTokenCreator"
    )
  }

Install detection rules in Elastic Security

Detect GCP IAM Service Account Impersonation Role Granted in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).