GCP Misconfiguration
Overview
Common GCP security misconfigurations:
- Public Cloud Storage buckets:
allUsersorallAuthenticatedUsersaccess - Service account key file exposure: SA keys committed to version control
- Overprivileged service accounts:
roles/editororroles/ownergranted - Default service account auto-mount: Pods automatically get default SA token
- Disabled audit logging: Data access logs disabled
- GKE legacy ABAC: Insecure legacy authorization model
Remediation
- Enable Uniform Bucket-Level Access to prevent per-object ACLs
- Use Workload Identity instead of service account key files
- Follow principle of least privilege for IAM bindings
- Enable VPC Service Controls