GCP IAM exploitation targets the identity and access management system of Google Cloud Platform to escalate privileges, access unauthorized resources, and move laterally across GCP projects. GCP's unique IAM model with organization, folder, project, and resource-level policies creates exploitation opportunities distinct from other cloud providers.
GCP IAM exploitation begins with understanding the permission hierarchy. Service account key theft provides persistent access independent of user authentication. Service account impersonation through iam.serviceAccounts.getAccessToken or iam.serviceAccounts.signJwt allows assuming other identities. Custom role manipulation with iam.roles.update can add permissions to existing roles. Overprivileged service accounts on Compute Engine instances are accessible through the metadata endpoint. Cross-project access exploits shared VPC configurations and overly permissive IAM bindings at the organization level. Tools like GCPBucketBrute enumerate exposed storage, while custom scripts leverage the gcloud CLI and REST APIs for privilege escalation. Workload Identity Federation misconfigurations can allow external identities to assume GCP roles.
GCP's hierarchical IAM model means that permissions granted at higher levels (organization, folder) cascade to all child resources. A single overprivileged binding at the organization level can compromise every project. Service account management is particularly critical because leaked service account keys provide persistent access that persists until explicitly revoked. Organizations using GCP must understand these unique IAM characteristics to prevent exploitation.
CDA covers GCP IAM exploitation within the IAT domain alongside AWS and Azure techniques. Theater missions provide multi-cloud assessment scenarios. Our approach ensures operators understand the unique security models of each major cloud provider rather than applying a one-size-fits-all methodology.