[Contribution] Add GCP HMAC issues - Githubissues

wiz-sec / open-cvdb

An open project to list all publicly known cloud vulnerabilities and CSP security issues

https://cloudvulndb.org

Creative Commons Attribution 4.0 International

297 stars 59 forks source link

[Contribution] Add GCP HMAC issues #322

Closed korniko98 closed 4 weeks ago

korniko98 commented 1 month ago

Summary (give a brief description of the issue)

Google Cloud Audit Logs do not record HMAC key creation or deletion events when associated with user accounts.
No Google Cloud API is available to administrators, preventing them from auditing the existence of HMAC keys associated with user accounts.
No Cloud IAM permissions are available to restrict the creation, deletion or usage of HMAC keys.

References (provide links to blogposts, etc.)

https://www.vectra.ai/blog/working-as-intended-the-unauditable-unmanageable-keys-in-google-cloud