GCP - Permissions for a Pentest

If you want to pentest a GCP environment you need to ask for enough permissions to check all or most of the services used in GCP. Ideally, you should ask the client to create:

Create a new project
Create a Service Account inside that project (get json credentials) or create a new user.
Give the Service account or the user the roles mentioned later over the ORGANIZATION
Enable the APIs mentioned later in this post in the created project

Set of permissions to use the tools proposed later:

APIs to enable (from starbase):

Individual tools permissions

PreviousGCP - Federation Abuse NextGCP - Post Exploitation

Last updated 5 months ago

gcloud services enable \
  serviceusage.googleapis.com \
  cloudfunctions.googleapis.com \
  storage.googleapis.com \
  iam.googleapis.com \
  cloudresourcemanager.googleapis.com \
  compute.googleapis.com \
  cloudkms.googleapis.com \
  sqladmin.googleapis.com \
  bigquery.googleapis.com \
  container.googleapis.com \
  dns.googleapis.com \
  logging.googleapis.com \
  monitoring.googleapis.com \
  binaryauthorization.googleapis.com \
  pubsub.googleapis.com \
  appengine.googleapis.com \
  run.googleapis.com \
  redis.googleapis.com \
  memcache.googleapis.com \
  apigateway.googleapis.com \
  spanner.googleapis.com \
  privateca.googleapis.com \
  cloudasset.googleapis.com \
  accesscontextmanager.googleapis.com