infrastructure-as-code pipelines that manage project iam bindings. add exceptions for the service accounts that run these pipelines.

Techniques

T1098

Sample rules

GCP Vertex AI Role Granted to Principal

source: elastic
technicques:
- T1098

Description

Identifies an IAM policy change on a Google Cloud project, folder, or organization that grants a Vertex AI role (roles/aiplatform.*) to a principal. Vertex AI roles control who can invoke models, deploy endpoints, run agents, and read prompt and training data. An adversary who has gained IAM administration rights can grant a Vertex AI role to an identity they control to keep model access after the original foothold is removed, or to run LLMjacking workloads under the victim’s billing. Google-managed service agent roles are excluded because Google grants them automatically when the API is enabled.

Detection logic

data_stream.dataset: "gcp.audit"
  and event.action: (
    "SetIamPolicy" or
    google.cloud.resourcemanager.v*.Folders.SetIamPolicy or
    google.cloud.resourcemanager.v*.Organizations.SetIamPolicy or
    google.cloud.resourcemanager.v*.Projects.SetIamPolicy
  )
  and not event.outcome: "failure"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (roles/aiplatform.* and not (*ServiceAgent or *serviceAgent))
  }