---
title: GCP IAM Service Account Impersonation Role Granted
description: Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/gcp/persistence_gcp_service_account_impersonation_role_grant
products:
  - Elastic Security
---

# GCP IAM Service Account Impersonation Role Granted
Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a
SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and
"roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service
account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant
themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account,
escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New
Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.
**Rule type**: new_terms
**Rule indices**:
- logs-gcp.audit-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/backdooring-service-account/](https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/backdooring-service-account/)](https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/backdooring-service-account/)
- [[https://stratus-red-team.cloud/attack-techniques/GCP/gcp.persistence.backdoor-service-account-policy/](https://stratus-red-team.cloud/attack-techniques/GCP/gcp.persistence.backdoor-service-account-policy/)](https://stratus-red-team.cloud/attack-techniques/GCP/gcp.persistence.backdoor-service-account-policy/)
- [[https://cloud.google.com/iam/docs/service-account-impersonation](https://cloud.google.com/iam/docs/service-account-impersonation)](https://cloud.google.com/iam/docs/service-account-impersonation)
- [[https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts](https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts)](https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts)

**Tags**:
- Domain: Cloud
- Data Source: GCP
- Data Source: Google Cloud Platform
- Data Source: GCP Audit Logs
- Use Case: Identity and Access Audit
- Use Case: Threat Detection
- Tactic: Persistence
- Tactic: Privilege Escalation
- Resources: Investigation Guide
- Noise: Unknown
- Performance: Normal
- Rule Type: New Terms
- Platform: GCP

**Version**: 2
**Rule authors**:
- Elastic
- Aryu Zaw

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating GCP IAM Service Account Impersonation Role Granted

Granting an impersonation role on a service account lets the bound member obtain that service account's credentials
without creating a long-lived key. `roles/iam.serviceAccountTokenCreator` and `roles/iam.serviceAccountOpenIdTokenCreator`
allow minting OAuth2 access tokens and OpenID Connect identity tokens, while `roles/iam.serviceAccountUser` allows the
member to attach (actAs) the service account to new resources. Adversaries abuse these grants to pivot to a
higher-privileged identity, escalate privileges, and persist in a way that is unaffected by key rotation or password
resets.

### Possible investigation steps

- Identify the granting principal via `user.email` and `user.id` and confirm whether that identity is expected to modify
  IAM policy on service accounts.
- Review the target service account in `gcp.audit.resource_name` and determine the permissions it holds. Impersonating a
  service account with broad project or organization roles represents a significant escalation.
- Inspect the granted binding in `gcp.audit.request` / `gcp.audit.response` to identify the member that was added
  (`user:`, `serviceAccount:`, `group:`, or an external domain). External or newly created members are higher risk.
- Examine `gcp.audit.request_metadata.caller_ip` and `gcp.audit.request_metadata.caller_supplied_user_agent` to assess
  whether the change originated from an expected location or tool.
- Correlate with recent activity by the granting principal, such as service account key creation, custom role creation,
  or `GenerateAccessToken` / `GenerateIdToken` calls that use the newly granted impersonation rights.


### False positive analysis

- Terraform, Deployment Manager, and CI/CD service accounts commonly grant serviceAccountUser and
  serviceAccountTokenCreator as part of normal provisioning. Baseline these principals and exclude them with exceptions.
- One-time grants during application onboarding or delegation may be legitimate. Validate against change management
  before escalating.


### Response and remediation

- If the grant is unauthorized, remove the impersonation binding from the service account's IAM policy.
- Revoke any access or identity tokens issued for the impacted service account and review its recent activity for abuse.
- Investigate the granting principal for compromise, rotate its credentials if necessary, and review what other IAM
  changes it has made.
- Restrict who can set IAM policy on service accounts and require justification or approval for impersonation grants.


## Rule Query

```kuery
data_stream.dataset: "gcp.audit"
  and event.action: google.iam.admin.v*.SetIAMPolicy
  and event.outcome: "success"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (
      "roles/iam.serviceAccountTokenCreator" or
      "roles/iam.serviceAccountUser" or
      "roles/iam.serviceAccountOpenIdTokenCreator"
    )
  }
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Account Manipulation
  - Id: T1098
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/)](https://attack.mitre.org/techniques/T1098/)
- Sub Technique:
  - Name: Additional Cloud Roles
  - Id: T1098.003
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/003/](https://attack.mitre.org/techniques/T1098/003/)](https://attack.mitre.org/techniques/T1098/003/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Privilege Escalation
  - Id: TA0004
  - Reference URL: [[https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/)](https://attack.mitre.org/tactics/TA0004/)
- Technique:
  - Name: Account Manipulation
  - Id: T1098
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/](https://attack.mitre.org/techniques/T1098/)](https://attack.mitre.org/techniques/T1098/)
- Sub Technique:
  - Name: Additional Cloud Roles
  - Id: T1098.003
  - Reference URL: [[https://attack.mitre.org/techniques/T1098/003/](https://attack.mitre.org/techniques/T1098/003/)](https://attack.mitre.org/techniques/T1098/003/)