GCP HMAC Keys do not log creation, deletion or usage

Summary

Cloud Audit Logs do not capture actions mediated through the cloud console private API service (cloudconsole-pa). Consequently, there is no logging of HMAC key creation or deletion linked to user accounts. This absence of logs hampers defenders' ability to alert or monitor the creation of HMAC keys for user accounts, posing a persistence risk, or their deletion, presenting a denial of service risk.

Affected Services

Google Cloud Storage XML API, Cloud Console Private API Service

Remediation

None possible

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/KatTraxler