services / Google Cloud / Cloud KMS Key Rings

A Cloud KMS key ring is a logical grouping of keys in the same location.

Cloud KMS is an extremely sensitive service. Keys can be used for encryption/decryption of sensitive data or for the creation or verification of digital signatures.

cloudkms.​keyRings.​createTagBinding

A common use case of tag bindings is for use in IAM policy conditions. The risks apply if the tag is used in any policies.

Risks

1. Privilege escalation (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links