services / Google Cloud / Compute Engine managed instance groups

Create and alter managed instance groups.

Allows creation, modification, and destruction of auto-scaling instance groups. Except for resizing, can not critically impact organizational functions.

compute.​instanceGroupManagers.​delete

Does not delete instances themselves, but can effectively remove network access to instances.

Risks

1. Infrastructure destruction (HIGH)
2. Network destruction (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links