services / Google Cloud / Service Account Keys

Service account keys are the credentials that service accounts use for authentication. Service accounts are Google accounts used by applications or workloads for authentication, and as result may have access to many Google services.

Service account keys are extremely sensitive since they allow users to authenticate as the service account.

iam.​serviceAccountKeys.​disable

This leads to a DOS in any application that is using the service account key for authentication.

Risks

1. Denial-of-service (HIGH)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links