developers or ci jobs with incomplete rbac can generate denied creates. tune after validating expected identities and namespaces. gke control-plane and bootstrap identities are excluded.

gcp
elastic

Techniques

Sample rules

GKE Forbidden Creation Request

source: elastic
technicques:

Description

Detects denied GKE API create requests from non-control-plane identities. Failed creates can indicate RBAC probing, stolen credentials with insufficient privileges, or attempts to deploy unauthorized workloads.

Detection logic

data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
event.action:*.create and
gcp.audit.status.message:(*forbidden* or *Unauthorized*) and
not client.user.email:(
  "system:apiserver" or system\:kube-* or "system:cloud-controller-manager" or system\:gke-* or
  system\:node\:* or system\:serviceaccount\:kube-system\:* or system\:serviceaccount\:gke-managed* or
  "kubelet-bootstrap" or "kubelet-nodepool-bootstrap" or "gcp:kube-bootstrap"
) and
not user_agent.original:(*kubernetes/$Format)