Detection: IAM Service Account Access Token Generated

Overview

Detect when an access token for an IAM service account was generated in GCP. Service account access tokens allow access to GCP resources, and unauthorized or excessive token generation can lead to security vulnerabilities or misuse. Monitoring these events ensures proper access control and prevents potential security risks.

References:

Usage

Run the detection in your terminal:

powerpipe detection run gcp_audit_log_detections.detection.iam_service_account_access_token_generated

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe detection run gcp_audit_log_detections.detection.iam_service_account_access_token_generated --share

SQL

This detection uses a named query:

select
  tp_timestamp as timestamp,
method_name as operation,
resource_name as resource,
authentication_info.principal_email as actor,
tp_source_ip as source_ip,
tp_index as project,
tp_id as source_id,
-- Create new aliases to preserve original row data
operation as operation_src,
resource as resource_src,
*
exclude operation, resource

from
  gcp_audit_log
where
  service_name = 'iamcredentials.googleapis.com'
  and method_name ilike 'generateaccesstoken'
  and severity != 'Error'
-- TODO: Do we need to check operation?
-- and (operation_src is null or operation_src.last = true)

order by
  timestamp desc;

Detection: IAM Service Account Access Token Generated

Overview

Usage

SQL

Tags