How do you detect IAM abuse in Google Cloud?

Alert on Admin Activity audit log entries for SetIamPolicy and service account key creation or upload, filtered to exclude your approved automation identities. Pay particular attention to bindings that add owner, editor, security admin or token creator roles, and to external or allUsers principals. Enable Data Access logs for IAM Credentials so impersonation and token generation are recorded. Export logs to BigQuery to join against an approved-administrator list, and use organisation policy constraints to block service account key creation outright.

Detecting GCP IAM Abuse in Cloud Audit Logs

Google Cloud grants access through IAM policy bindings on organisations, folders, projects and resources, and through service accounts that can be impersonated or issued keys. An attacker with a foothold escalates by adding a binding for themselves, creating a long-lived service account key, or impersonating a more privileged account. These actions appear in Admin Activity audit logs, which are on by default and cannot be disabled.

Signals at a Glance

Signal	Where	ATT&CK
SetIamPolicy adding owner, editor or security-admin style bindings	Admin Activity audit logs	T1098.003
CreateServiceAccountKey, especially user-managed keys	Admin Activity audit logs	T1098.001
GenerateAccessToken or signJwt impersonation across service accounts	Data Access audit logs	T1078.004
New service account created and granted roles within minutes	Admin Activity audit logs	T1136.003
External or allUsers principals added to a policy	Admin Activity audit logs	T1098

Logs Explorer Filters

Admin Activity logs record policy changes and key creation. This filter is a good starting alert in Logs Explorer or a log-based alert, and narrows to the methods that matter:

# Cloud Logging filter - IAM policy changes and service account key creation
logName:"cloudaudit.googleapis.com%2Factivity"
AND (
  protoPayload.methodName="SetIamPolicy"
  OR protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"
  OR protoPayload.methodName="google.iam.admin.v1.UploadServiceAccountKey"
  OR protoPayload.methodName="google.iam.admin.v1.CreateServiceAccount"
  OR protoPayload.methodName="google.iam.admin.v1.SetIAMPolicy"
)
AND NOT protoPayload.authenticationInfo.principalEmail:"@your-automation-project.iam.gserviceaccount.com"
# tune/validate: confirm methodName strings in your own logs; Terraform and deployment service accounts need an allowlist

Alert when a binding adds roles/owner, roles/editor, roles/iam.securityAdmin, roles/iam.serviceAccountKeyAdmin or roles/iam.serviceAccountTokenCreator.
Enforce the organisation policy constraints that disable service account key creation and upload, so any attempt is both blocked and loud.
Enable Data Access audit logs for IAM Credentials so token generation and impersonation become visible.

BigQuery Over Exported Logs

If you export audit logs to BigQuery, SQL gives you joins, baselines and history. This query lists IAM policy changes and the principals that made them, which you can compare with a list of approved administrators:

-- BigQuery SQL - IAM policy changes and key creation from exported Admin Activity logs
-- validate: the table name depends on your sink; the dataset below is a placeholder
SELECT
  timestamp,
  protopayload_auditlog.authenticationInfo.principalEmail AS actor,
  protopayload_auditlog.requestMetadata.callerIp AS caller_ip,
  protopayload_auditlog.methodName AS method,
  protopayload_auditlog.resourceName AS resource,
  protopayload_auditlog.authorizationInfo AS authz
FROM `my-project.audit_logs.cloudaudit_googleapis_com_activity_*`
WHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))
  AND protopayload_auditlog.methodName IN (
        'SetIamPolicy',
        'google.iam.admin.v1.CreateServiceAccountKey',
        'google.iam.admin.v1.UploadServiceAccountKey')
  AND protopayload_auditlog.authenticationInfo.principalEmail NOT IN (SELECT email FROM `my-project.reference.approved_iam_admins`)
ORDER BY timestamp DESC;

Correlate the caller IP with prior activity for the principal; a key created from a new network is far more suspicious than one created from CI.
Use Security Command Center and IAM recommender to find overly broad bindings before an attacker does.

Vetted sources

Use Google Cloud audit logging documentation, Security Command Center Event Threat Detection finding categories, the SigmaHQ GCP rules and Elastic GCP detection rules. Baseline your own environment, because infrastructure-as-code service accounts perform most legitimate IAM changes.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Logs Explorer Filters

BigQuery Over Exported Logs

Build Detections That Fire

Identity & Cloud Attack Detection

Detection Hub

Cloud Privilege Escalation Detection

AWS Access Key Abuse Detection