services / Google Cloud / Cloud Monitoring Alert Policies

Defines the conditions that trigger a notification when monitored metrics behave unexpectedly.

monitoring.​alertPolicies.​deleteTagBinding

A common use case of tag bindings is for use in IAM policy conditions. The risks apply if the tag is used in any policies.

Risks

1. Policy destruction (CRITICAL)
2. Privilege escalation (CRITICAL)
3. Denial-of-access (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links