1

In the Google Cloud Platform Console, the Compute Engine API metrics indicate that on December 12, an anonymous-credentialed someone started making automated "list" API calls for resources on my GCP account.

Charts showing API calls step up

Why are people allowed to anonymously hit resource "list" APIs on my GCP account? Is there a way to restrict them? Is there a way to find out who is making these calls?

5
  • 2
    Can you post one of the entries from the logs from the Google Cloud Console? I would like to look at this. Dec 25, 2018 at 3:31
  • Can you point me to where I can find them? There's nothing in Stackdriver Logging (console.cloud.google.com/logs/viewer).
    – brandones
    Dec 27, 2018 at 5:03
  • I have never seen this issue, so I do not know which service to specify for the logs. I focus heavily on GCP security, IAM, Authentication, etc. so please ping me for any updates. Dec 27, 2018 at 6:03
  • 1
    The metric shows anonymous users making the request, it does not show whether those requests were serviced. If a successful list API call is made for any resource in your project, that should show up in the logs. It is entirely possible that these requests were made but rejected by IAM
    – Patrick W
    Jan 14, 2019 at 19:01
  • Ah, okay, I imagine that's what's happening. The only API calls I see in the logs are the ones I've made. It's weird that someone has been making API calls against my compute engine account at 0.3/s for more than a month now. Anyway, thanks for the clarification, Patrick.
    – brandones
    Jan 14, 2019 at 22:50

1 Answer 1

1

The metric shows anonymous users making the request, it does not show whether those requests were serviced. If a successful list API call is made for any resource in your project, that should show up in the logs. It is entirely possible that these requests were made but rejected by IAM

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .