Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Info about KMS:
GCP - KMS EnumNote that in KMS the permission are not only inherited from Orgs, Folders and Projects but also from Keyrings.
cloudkms.cryptoKeyVersions.useToDecryptYou can use this permission to decrypt information with the key you have this permission over.
cloudkms.cryptoKeys.setIamPolicyAn attacker with this permission could give himself permissions to use the key to decrypt information.
cloudkms.cryptoKeyVersions.useToDecryptViaDelegationHere's a conceptual breakdown of how this delegation works:
Service Account A has direct access to decrypt using a specific key in KMS.
Service Account B is granted the useToDecryptViaDelegation permission. This allows it to request KMS to decrypt data on behalf of Service Account A.
The usage of this permission is implicit in the way that the KMS service checks permissions when a decryption request is made.
When you make a standard decryption request using the Google Cloud KMS API (in Python or another language), the service checks whether the requesting service account has the necessary permissions. If the request is made by a service account with the useToDecryptViaDelegation permission, KMS verifies whether this account is allowed to request decryption on behalf of the entity that owns the key.
Define the Custom Role: Create a YAML file (e.g., custom_role.yaml) that defines the custom role. This file should include the cloudkms.cryptoKeyVersions.useToDecryptViaDelegation permission. Here's an example of what this file might look like:
Create the Custom Role Using the gcloud CLI: Use the following command to create the custom role in your Google Cloud project:
Replace [YOUR_PROJECT_ID] with your Google Cloud project ID.
Grant the Custom Role to a Service Account: Assign your custom role to a service account that will be using this permission. Use the following command:
Replace [YOUR_PROJECT_ID] and [SERVICE_ACCOUNT_EMAIL] with your project ID and the email of the service account, respectively.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
