API

Google Cloud IAM policy modified

Documentos > Datadog Security > OOTB Rules > Google Cloud IAM policy modified

Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect a change to the IAM policy.

Strategy

This rule lets you monitor Google Cloud Admin activity audit logs to determine when the SetIamPolicy method is invoked.

Triage and response

Review the log and inspect the policy deltas (@data.protoPayload.serviceData.policyDelta.bindingDeltas) and ensure none of the actions are REMOVE.