1

In the Google Cloud Platform Console, the Compute Engine API metrics indicate that on December 12, an anonymous-credentialed someone started making automated "list" API calls for resources on my GCP account.

Charts showing API calls step up

Why are people allowed to anonymously hit resource "list" APIs on my GCP account? Is there a way to restrict them? Is there a way to find out who is making these calls?

5
  • 2
    Can you post one of the entries from the logs from the Google Cloud Console? I would like to look at this. – John Hanley Dec 25 '18 at 3:31
  • Can you point me to where I can find them? There's nothing in Stackdriver Logging (console.cloud.google.com/logs/viewer). – brandones Dec 27 '18 at 5:03
  • I have never seen this issue, so I do not know which service to specify for the logs. I focus heavily on GCP security, IAM, Authentication, etc. so please ping me for any updates. – John Hanley Dec 27 '18 at 6:03
  • 1
    The metric shows anonymous users making the request, it does not show whether those requests were serviced. If a successful list API call is made for any resource in your project, that should show up in the logs. It is entirely possible that these requests were made but rejected by IAM – Patrick W Jan 14 '19 at 19:01
  • Ah, okay, I imagine that's what's happening. The only API calls I see in the logs are the ones I've made. It's weird that someone has been making API calls against my compute engine account at 0.3/s for more than a month now. Anyway, thanks for the clarification, Patrick. – brandones Jan 14 '19 at 22:50
1

The metric shows anonymous users making the request, it does not show whether those requests were serviced. If a successful list API call is made for any resource in your project, that should show up in the logs. It is entirely possible that these requests were made but rejected by IAM

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.