I would like to monitor for Compute Engine service accounts that attempt API calls beyond their given Access Scope. This could be via the
gcloud command or manual API interaction using the OAuth token from the metadata server.
Here is a specific example:
- A Compute Instance is launched with the general GCP defaults, including the default service account and the default access scopes.
- A user logs into a SSH session on that Compute Instance and
gcloud auth listshows that the active account is the default service account.
- The user runs
gcloud compute instances list. This fails with
Insufficient Permission: Request had insufficient authentication scopesdue to the Access Scope limitation.
However, I can't find anything in StackDriver that relates to this attempt. I've configured Cloud Audit Logs for
Data Read, and
Data Write for all services.
I do see log events for successful API calls, for example if I remove the scope limitation and repeat the steps above.
I also see log events for failed API calls that had a proper access scope but lacked IAM permissions.
However, nothing for attempts that fail specifically due to access scope.
Does anyone know if this is possible?