DETECT TRANSITIVE ACCESS TO SENSITIVE GOOGLE CLOUD RESOURCES

Summary from the TLDR InfoSec newsletter

This article discusses transitive access via service accounts in GCP that could allow users to access services as Service Accounts, gaining access to all the IAM resources tied to those accounts. It details the IAM permissions that allow for this, detection methods like using Google Policy Analyzer, and how to identify these service accounts using Google APIs.