google / google/gcp_scanner

Bug: Do not stop enumerating project if resource manager is disabled in SA project.

Open
#266 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
370
Forks
114
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
The scanner fails if the service account token does not have access to list projects via resources manager. When scanning service account keys json files, that includes `project_id`, this may lead to "false positives" as the SA may have access to other services in the current project.

**To Reproduce**

Steps to reproduce the behavior:
1. Create a SA in a project that has Resource Manager disabled, save the credentials to:
`keys/sa.json`:
```
{
"type": "service_account",
"project_id": "my-project-00",
"private_key_id": "",
"private_key": "",
"client_email": "asdfasdf@my-project-00iam.gserviceaccount.com",
"client_id": "",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://accounts.google.com/o/oauth2/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": ""
}
```

and run `python3 -m gcp_scanner --sa-key-path keys -o output -l INFO`

3. This will give you this output:
```
2023-08-07 10:39:53 - INFO - >> current service account: asdfasdf@my-project-00.iam.gserviceaccount.com
2023-08-07 10:39:53 - INFO - Retrieving projects list
2023-08-07 10:39:53 - INFO - Failed to enumerate projects
2023-08-07 10:39:53 - INFO - (, , )
```

**Expected behavior**
When resource manager is disabled, the scanner should not abort enumerating resources in the current project. It still knows one project from the json file, and the impact in that project can be assessed.

**Current behavior**
See steps to reproduce

**Additional context**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.