---
title: >-
  Service account can use impersonation chaining to access a crown jewel GCS
  bucket
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Service account can use impersonation
  chaining to access a crown jewel GCS bucket
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Service account can use impersonation chaining to access a crown jewel GCS bucket

## Description{% #description %}

A service account can use impersonation chaining to access a crown jewel Cloud Storage bucket. If an attacker gains access to this service account, they can impersonate one or more other service accounts in sequence, following a chain of trust relationships to ultimately read data from a business-critical bucket.

## Remediation{% #remediation %}

1. [Review and restrict service account impersonation permissions](https://cloud.google.com/iam/docs/service-account-permissions) (`roles/iam.serviceAccountTokenCreator` and related bindings) to limit which principals can impersonate each service account.
1. Apply [least privilege best practices for service accounts](https://cloud.google.com/iam/docs/best-practices-service-accounts) to ensure impersonation chains cannot be used to reach sensitive resources.