Description

A service account can use impersonation chaining to access a crown jewel Cloud Storage bucket. If an attacker gains access to this service account, they can impersonate one or more other service accounts in sequence, following a chain of trust relationships to ultimately read data from a business-critical bucket.

Remediation

1. Review and restrict service account impersonation permissions (roles/iam.serviceAccountTokenCreator and related bindings) to limit which principals can impersonate each service account.
2. Apply least privilege best practices for service accounts to ensure impersonation chains cannot be used to reach sensitive resources.