Organization Policy Service

Abusable GCP permissions that can lead to compromise or privilege escalation

orgpolicy.policy.set

Changing organization policies can take a few minutes before the change takes effect

• Because Organization Policies enforce constraints on who can do what, an attacker with this permission could lift the policy constraint and then perform the previously constrained action.

• This example shows disabling one of Google's managed policies but an attacker could also create or modify a policy.

gcloud org-policies set-policy disableServiceAccountKeyCreation.yaml

name: organizations/<ProjectId>/policies/iam.managed.disableServiceAccountKeyCreation
spec:
  rules:
  - enforce: false