GCP IAM policy has over-provisioned principals
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Description
To mitigate the impact of credential exposure or compromise, IAM bindings should be
scoped down to the least level of privilege needed to perform their responsibilities.
This rule identifies when a principal’s granted permissions are significantly broader
than what it has used previously. Datadog considers a permissions gap to be large when
the number of unused permissions is greater than 40% of the total permissions count.
Rationale
By comparing the GCP audit log activity for a principal with the permissions its IAM
bindings grant, Datadog can identify a permissions gap. Unused permissions represent
unnecessary risk: if credentials are compromised, an attacker can use any permission
the principal holds — not just the ones it normally uses. Reducing permissions to what
are actually needed limits the blast radius of a potential compromise.
Datadog recommends reducing the IAM permissions attached to the principal to the minimum
necessary for it to fulfill its function. Use GCP IAM Recommender to generate
least-privilege role suggestions based on past Cloud Audit Log activity. Remove or
replace role bindings that contribute the unused permissions identified in this finding.
