services / Google Cloud / Google Cloud SQL

SSL client certificates for connecting to a Cloud SQL instance. Each instance can have 10 client certificates.

Cloud SQL is used to store and serve sensitive and application-critical data. Breach of a cloud SQL database can lead to exfiltration of highly sensitive data, or interruption of mission-critical applications.

cloudsql.​sslCerts.​createEphemeral

This permission allows creating an ephemeral client SSL certificate for the instance, which allows the user to establish a connection to the instance. Note that authentication into the database is still separate, so this does not provide access to data.

Risks

1. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links