GCP Attack Paths

GCP attacks center on service accounts — the IAM primitives that VMs, Cloud Functions, and pipelines use. Compromise a service account key or access the GCE metadata server, and you inherit whatever that SA can do. IAM conditions misconfigs, workload identity federation abuse, and Storage bucket enumeration complete the attack chain. Cloud Audit Logs and SCC are the detection layer.