GCP-IAM - GCS Bucket IAM Policy Modified by the Acting Principal

Christopher Scott@Scocha

•updated Aug 8, 2026•0•0•1

This rule detects when a user (excluding service accounts) explicitly sets IAM permissions on a Google Cloud Storage bucket, potentially indicating unauthorized privilege escalation or modification of access controls to facilitate data exfiltration or persistence.