services / Google Cloud / Cloud Monitoring Metrics Scopes

Links one or more monitored projects to a single scoping project, letting it query metrics across all of them.

monitoring.​metricsScopes.​link

Also covers unlinking. Linking a project grants the scoping project's viewers access to its metrics, a cross-project privilege boundary bypass rather than a plain read. Unlinking silently drops a project from a security team's centralized cross-project view.

Risks

1. Lateral movement (BOOST)
2. Metadata exfiltration (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links