search

google / cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud
Apache License 2.0
454 stars 88 forks source link

Remove a service account attachment from an instance #278

Closed ramo-j closed 3 years ago

ramo-j commented 3 years ago

Feature - Upon discovery of a compromise, a operator should be able to quickly remove service accounts attached to instances to prevent any API activity from a malicious actor with access.

Note, already issued service account tokens cannot be revoked[1] but have a default lifespan of 1 hour[2].

[1] https://cloud.google.com/sdk/gcloud/reference/auth/revoke - When given a service account, this command does not revoke the service account token on the server because service account tokens are not revocable. [2] https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials - By default, the maximum token lifetime is 1 hour (3,600 seconds).

tomchop commented 3 years ago

Closing here as #281 has been merged.

Tip: if you add "closes #278" or "fixes #278" somewhere in the PR title or description, it will automatically close the mentioned issues.