Audit Log Service Account Delegation Analysis

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security operations team is investigating an incident triggered by an Event Threat Detection finding: Privilege Escalation: Anomalous Multistep Service Account Delegation for Admin Activity.

While analyzing the raw Google Cloud Admin Activity audit log entry associated with the incident in Cloud Logging, the analyst observes the following authenticationInfo and requestMetadata structure:

{
  "protoPayload": {
    "serviceName": "storage.googleapis.com",
    "methodName": "storage.buckets.setIamPolicy",
    "authenticationInfo": {
      "principalEmail": "prod-backup-manager@company-prod.iam.gserviceaccount.com",
      "serviceAccountDelegationInfo": [
        {
          "principalEmail": "cicd-deployer@company-prod.iam.gserviceaccount.com"
        },
        {
          "principalEmail": "external-contractor@partner.com"
        }
      ]
    },
    "requestMetadata": {
      "callerIp": "198.51.100.24"
    }
  }
}

How should the security analyst interpret the identity hierarchy and audit fields to reconstruct this security event?

The API call was executed under the authority of external-contractor, who directly impersonated cicd-deployer, while prod-backup-manager represents the target resource being modified.

The API call was initiated by cicd-deployer because it appears first in serviceAccountDelegationInfo, and external-contractor is an authorized spectator or secondary approver.

The API call was executed under the authority of prod-backup-manager, the original caller who initiated the chain was external-contractor, and cicd-deployer served as an intermediate delegated service account.

The API call was executed directly by prod-backup-manager without delegation, and the serviceAccountDelegationInfo list displays the identities whose IAM permissions were removed by the policy update.

Professional Cloud Security Engineer

Audit Log Service Account Delegation Analysis

Related questions