Description

A service account can escalate privileges to another service account that can read a crown jewel Cloud Storage bucket. If an attacker gains access to the first service account, they can use privilege-escalation permissions to assume the capabilities of the second account and read data from a business-critical bucket.

Remediation

1. Review and restrict privilege-escalation permissions (e.g. roles/iam.serviceAccountTokenCreator, iam.serviceAccounts.actAs, and related bindings) between service accounts.
2. Apply least privilege best practices for service accounts to ensure escalation paths cannot be used to reach sensitive resources.