Cloud Credentials Rotation - GCP

id: Cloud Credentials Rotation - GCP
version: -1
name: Cloud Credentials Rotation - GCP
description: |-
  ## **GCP Credentials Rotation Playbook**

  ### **IAM Remediation**
  For compromised service accounts:
  - **Access Key Disabling**: Immediately disable the compromised service account access key.

  - **New Key Generation**: After ensuring the old key is disabled, generate a new access key.

  ### **GSuite Admin Remediation**
  Admin accounts are crucial:
  - **Reset Password**: Resets the user password to halt any unauthorized access.

  - **Revoke Access Token**: Revoke any suspicious or unauthorized access tokens.

  - **Combo Action**: Reset the password and revoke access tokens to ensure complete safety.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 97236be9-5405-410e-8660-81f5ee7e9c65
    type: start
    task:
      id: 97236be9-5405-410e-8660-81f5ee7e9c65
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1440,
          "y": -40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: c2a274db-fb51-4049-8009-a7d72635685d
    type: regular
    task:
      id: c2a274db-fb51-4049-8009-a7d72635685d
      version: -1
      name: List zone related instances
      description: Retrieves the list of instances contained within the specified zone.
      script: '|||gcp-compute-list-instances'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      zone:
        complex:
          root: inputs.zone
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 55df6642-23fc-449f-88d5-41a87268aa33
    type: regular
    task:
      id: 55df6642-23fc-449f-88d5-41a87268aa33
      version: -1
      name: Set possible compromised instances
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      key:
        simple: possibleCompromisedInstances
      value:
        complex:
          root: GoogleCloudCompute.Instances
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: GoogleCloudCompute.Instances.serviceAccounts.email
                iscontext: true
              right:
                value:
                  simple: inputs.serviceAccountEmail
                iscontext: true
              ignorecase: true
          accessor: name
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: c8da559a-4bf0-45cb-80b5-2e12504ebc4c
    type: regular
    task:
      id: c8da559a-4bf0-45cb-80b5-2e12504ebc4c
      version: -1
      name: Disable the SA access key
      description: Disables a service account key.
      script: '|||gcp-iam-service-account-key-disable'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      key_name:
        complex:
          root: GCPIAM.ServiceAccountKey
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: GCPIAM.ServiceAccountKey.keyType
                iscontext: true
              right:
                value:
                  simple: USER_MANAGED
              ignorecase: true
          accessor: name
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: d53db53c-f69d-4637-833c-52d2f7793d45
    type: title
    task:
      id: d53db53c-f69d-4637-833c-52d2f7793d45
      version: -1
      name: GCP IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 938c214c-b12b-4385-8f6e-3e08bb17cdee
    type: title
    task:
      id: 938c214c-b12b-4385-8f6e-3e08bb17cdee
      version: -1
      name: GSuite Admin
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2050,
          "y": 285
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 583b9d1b-6b72-4016-8e0b-c74ec8a31949
    type: regular
    task:
      id: 583b9d1b-6b72-4016-8e0b-c74ec8a31949
      version: -1
      name: Revoke access token
      description: Delete all access tokens issued by a user for an application.
      script: '|||gsuite-token-revoke'
      type: regular
      iscommand: true
      brand: GSuiteAdmin
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      client_id:
        complex:
          root: inputs.clientID
      user_key:
        complex:
          root: inputs.userID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2480,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 245d5d3a-a9c3-4e95-803a-d880242426bc
    type: regular
    task:
      id: 245d5d3a-a9c3-4e95-803a-d880242426bc
      version: -1
      name: Reset password
      description: Updates a user.
      script: '|||gsuite-user-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      password:
        complex:
          root: NEW_PASSWORD
      user_key:
        complex:
          root: inputs.userID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2050,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 6f5cb0a9-73fa-41de-87f5-aed9d1ea4314
    type: condition
    task:
      id: 6f5cb0a9-73fa-41de-87f5-aed9d1ea4314
      version: -1
      name: Check remediation type
      description: Checks the remediation type provided by the user.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      ALL:
      - "15"
      Reset Password:
      - "26"
      Revoke Access Key:
      - "11"
    separatecontext: false
    conditions:
    - label: Revoke Access Key
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.GSuiteRemediationType
            iscontext: true
          right:
            value:
              simple: Revoke
          ignorecase: true
    - label: Reset Password
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.GSuiteRemediationType
            iscontext: true
          right:
            value:
              simple: Reset
          ignorecase: true
    - label: ALL
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.GSuiteRemediationType
            iscontext: true
          right:
            value:
              simple: ALL
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2050,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: d286d49d-29f1-4ab2-84b5-ac4f184bf669
    type: title
    task:
      id: d286d49d-29f1-4ab2-84b5-ac4f184bf669
      version: -1
      name: ALL
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2860,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 54427b29-32dc-4a4f-8fd9-1ba930a24f1e
    type: title
    task:
      id: 54427b29-32dc-4a4f-8fd9-1ba930a24f1e
      version: -1
      name: IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 285
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: e3137645-f549-499c-80f6-509fa3e2f549
    type: title
    task:
      id: e3137645-f549-499c-80f6-509fa3e2f549
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1440,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: be4ec206-ae55-4e9f-8d22-4e85ccac6b12
    type: regular
    task:
      id: be4ec206-ae55-4e9f-8d22-4e85ccac6b12
      version: -1
      name: Rotate the SA access key
      description: Creates a service account key. A service account can have up to 10 keys. Service account keys that you create don't have an expiry date and stay valid until you delete them.
      script: '|||gcp-iam-service-account-key-create'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      key_algorithm:
        simple: KEY_ALG_RSA_2048
      service_account_name:
        complex:
          root: GCPIAM.ServiceAccount
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: GCPIAM.ServiceAccount.email
                iscontext: true
              right:
                value:
                  simple: inputs.serviceAccountEmail
                iscontext: true
              ignorecase: true
          accessor: name
          transformers:
          - operator: FirstArrayElement
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 15988aab-f39b-434b-845d-67c5afd9dd42
    type: regular
    task:
      id: 15988aab-f39b-434b-845d-67c5afd9dd42
      version: -1
      name: Get the service account keys
      description: 'Lists service account keys, or retrieves a specific service account key information. One of the arguments: ''service_account_name'' or ''key_name''  must be provided.'
      script: '|||gcp-iam-service-account-keys-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      service_account_name:
        complex:
          root: GCPIAM.ServiceAccount
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: GCPIAM.ServiceAccount.email
                iscontext: true
              right:
                value:
                  simple: inputs.serviceAccountEmail
                iscontext: true
          accessor: name
          transformers:
          - operator: FirstArrayElement
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 1a01cfe3-cc5b-45f0-8ed2-61cf0d109676
    type: regular
    task:
      id: 1a01cfe3-cc5b-45f0-8ed2-61cf0d109676
      version: -1
      name: Generate Password
      description: "This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements).  The default behavior is to generate a password of  *random length* including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. \n\nThe min_* values all default to 0. This means that if the command is executed in this way:\n!GeneratePassword max_lcase=10\nIt is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches. \n\nThe debug parameter will print certain properties of the command into the WarRoom for easy diagnostics."
      scriptName: GeneratePassword
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      min_digits:
        simple: "5"
      min_lcase:
        simple: "5"
      min_symbols:
        simple: "1"
      min_ucase:
        simple: "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2050,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 7998e364-c06d-4c7e-8799-32d1ada7aa64
    type: regular
    task:
      id: 7998e364-c06d-4c7e-8799-32d1ada7aa64
      version: -1
      name: List service accounts
      description: 'Lists service accounts in project, or retrieves a specific service accounts information. One of the arguments: ''service_account_name'' or ''project_name''  must be provided.'
      script: '|||gcp-iam-service-accounts-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      limit:
        simple: "100"
      project_name:
        complex:
          root: inputs.cloudProject
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: e4c0bc44-856f-48cd-85a9-b6e699dd8b17
    type: condition
    task:
      id: e4c0bc44-856f-48cd-85a9-b6e699dd8b17
      version: -1
      name: Check identity type
      description: Checks the identity type that was part of the alert.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      SA:
      - "18"
      USER:
      - "10"
    separatecontext: false
    conditions:
    - label: SA
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.identityType
            iscontext: true
          right:
            value:
              simple: SERVICE_ACCOUNT
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.zone
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.serviceAccountEmail
            iscontext: true
    - label: USER
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.identityType
            iscontext: true
          right:
            value:
              simple: User
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.userID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1440,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: a12c7ce8-164a-4b6f-8d46-41d0600e6ea3
    type: condition
    task:
      id: a12c7ce8-164a-4b6f-8d46-41d0600e6ea3
      version: -1
      name: Was the service account retrieved in the previous task?
      description: Checks if the alerted service account is part of the 'service-accounts-get' response.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "22"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: containsString
          left:
            value:
              complex:
                root: GCPIAM.ServiceAccount
                accessor: email
            iscontext: true
          right:
            value:
              complex:
                root: inputs.serviceAccountEmail
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 890,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "14_11_Revoke Access Key": 0.77,
      "14_15_ALL": 0.33,
      "14_22_#default#": 0.21,
      "14_26_Reset Password": 0.59,
      "28_10_USER": 0.73,
      "28_18_SA": 0.68,
      "28_22_#default#": 0.1,
      "29_22_#default#": 0.37,
      "29_25_yes": 0.42
    },
    "paper": {
      "dimensions": {
        "height": 1815,
        "width": 2350,
        "x": 890,
        "y": -40
      }
    }
  }
inputs:
- key: GSuiteRemediationType
  value: {}
  required: false
  description: |-
    The response playbook provides the following remediation actions using GSuite Admin:

    Reset: By entering "Reset" in the input, the playbook will execute password reset.

    Revoke: By entering "Revoke" in the input, the playbook will execute access key suspension. (Both the user and client IDs must be provided)

    ALL: By entering "ALL" in the input, the playbook will execute the password reset and revoke access key tasks.
  playbookInputQuery:
- key: userID
  value: {}
  required: false
  description: Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID.
  playbookInputQuery:
- key: clientID
  value: {}
  required: false
  description: The client ID.
  playbookInputQuery:
- key: zone
  value: {}
  required: false
  description: The name of the zone.
  playbookInputQuery:
- key: serviceAccountEmail
  value: {}
  required: false
  description: The service account email.
  playbookInputQuery:
- key: identityType
  value: {}
  required: false
  description: |-
    The type of identity involved. Usually mapped to the incident field named 'cloudidentitytype'.
    e.g.
    USER,SERVICE_ACCOUNT,APPLICATION
  playbookInputQuery:
- key: cloudProject
  value: {}
  required: false
  description: The relevant project that the alert relates to.
  playbookInputQuery:
outputs:
- contextPath: GoogleCloudCompute.Instances
  description: Google Cloud Compute instance information.
  type: unknown
- contextPath: GCPIAM.ServiceAccountKey
  description: The service account keys.
  type: unknown
- contextPath: GCPIAM.ServiceAccount
  description: The service account information.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.9.0