logging.exclusions.create – 1 risks

The IAM Privilege Catalog

services / Google Cloud / Cloud Logging Exclusion

A Cloud Logging Exclusion specifies a set of log entries that are filtered out by a sink.

Exclusion operations apply to the _Default logging sink. An attacker may manipulate exclusions to hide their activity in order to evade detection.

logging.exclusions.create

Risks

Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links

https://cloud.google.com/logging/docs/access-control

https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects.exclusions

Contributed by P0 Security

© 2023–present P0 Security and contributors to the IAM Privilege Catalog