GCP IAM Service Account Impersonation Role Granted
ELASTIC detection rule by Elastic, Aryu Zaw · Elastic License v2
Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a
SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and
"roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service
account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant
themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account,
escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New
Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.
[metadata]
creation_date = "2026/05/30"
integration = ["gcp"]
maturity = "production"
updated_date = "2026/05/30"
[rule]
author = ["Elastic", "Aryu Zaw"]
description = """
Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a
SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and
"roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service
account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant
themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account,
escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New
Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.
"""
false_positives = [
"""
Infrastructure-as-code tooling (e.g. Terraform), CI/CD pipelines, and platform automation routinely grant
serviceAccountUser or serviceAccountTokenCreator when wiring up workloads, deployments, or impersonation chains.
Identify the expected automation principals and target service accounts and add exceptions for them.
""",
"""
Administrators may grant impersonation roles when onboarding new applications or delegating access. Verify that the
grant aligns with a known change and that both the granting principal and the added member are expected.
""",
]
from = "now-9m"
index = ["logs-gcp.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "GCP IAM Service Account Impersonation Role Granted"
note = """## Triage and analysis
### Investigating GCP IAM Service Account Impersonation Role Granted
Granting an impersonation role on a service account lets the bound member obtain that service account's credentials
without creating a long-lived key. `roles/iam.serviceAccountTokenCreator` and `roles/iam.serviceAccountOpenIdTokenCreator`
allow minting OAuth2 access tokens and OpenID Connect identity tokens, while `roles/iam.serviceAccountUser` allows the
member to attach (actAs) the service account to new resources. Adversaries abuse these grants to pivot to a
higher-privileged identity, escalate privileges, and persist in a way that is unaffected by key rotation or password
resets.
### Possible investigation steps
- Identify the granting principal via `user.email` and `user.id` and confirm whether that identity is expected to modify
IAM policy on service accounts.
- Review the target service account in `gcp.audit.resource_name` and determine the permissions it holds. Impersonating a
service account with broad project or organization roles represents a significant escalation.
- Inspect the granted binding in `gcp.audit.request` / `gcp.audit.response` to identify the member that was added
(`user:`, `serviceAccount:`, `group:`, or an external domain). External or newly created members are higher risk.
- Examine `gcp.audit.request_metadata.caller_ip` and `gcp.audit.request_metadata.caller_supplied_user_agent` to assess
whether the change originated from an expected location or tool.
- Correlate with recent activity by the granting principal, such as service account key creation, custom role creation,
or `GenerateAccessToken` / `GenerateIdToken` calls that use the newly granted impersonation rights.
### False positive analysis
- Terraform, Deployment Manager, and CI/CD service accounts commonly grant serviceAccountUser and
serviceAccountTokenCreator as part of normal provisioning. Baseline these principals and exclude them with exceptions.
- One-time grants during application onboarding or delegation may be legitimate. Validate against change management
before escalating.
### Response and remediation
- If the grant is unauthorized, remove the impersonation binding from the service account's IAM policy.
- Revoke any access or identity tokens issued for the impacted service account and review its recent activity for abuse.
- Investigate the granting principal for compromise, rotate its credentials if necessary, and review what other IAM
changes it has made.
- Restrict who can set IAM policy on service accounts and require justification or approval for impersonation grants."""
references = [
"https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/backdooring-service-account/",
"https://stratus-red-team.cloud/attack-techniques/GCP/gcp.persistence.backdoor-service-account-policy/",
"https://cloud.google.com/iam/docs/service-account-impersonation",
"https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts",
]
risk_score = 47
rule_id = "197d2757-eea1-46f9-9ebd-84646d2b45fa"
severity = "medium"
tags = [
"Domain: Cloud",
"Data Source: GCP",
"Data Source: GCP Audit Logs",
"Data Source: Google Cloud Platform",
"Use Case: Identity and Access Audit",
"Use Case: Threat Detection",
"Tactic: Persistence",
"Tactic: Privilege Escalation",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"
query = '''
data_stream.dataset: "gcp.audit"
and event.action: google.iam.admin.v*.SetIAMPolicy
and event.outcome: "success"
and gcp.audit.service_data.policy_delta.binding_deltas:{
action: "ADD" and
role: (
"roles/iam.serviceAccountTokenCreator" or
"roles/iam.serviceAccountUser" or
"roles/iam.serviceAccountOpenIdTokenCreator"
)
}
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"
[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[rule.new_terms]
field = "new_terms_fields"
value = ["user.id"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"