THE DARK CLOUD AROUND GCP SERVICE ACCOUNTS

Summary from the TLDR InfoSec newsletter

Dave Bogle of Red Canary steps through the process of investigating a strange behavior in GCP where a service account's access to GCP wasn't revoked when the access key was deleted. Bogle discovered that the token that GCP creates for service account's access access is not revocable but ultimately this is mentioned in the GCP documentation. In this post, Bogle walks through how he created detection logic around this behavior based on his research.