id: Cloud Credentials Rotation - GCP version: -1 name: Cloud Credentials Rotation - GCP description: |- ## **GCP Credentials Rotation Playbook** ### **IAM Remediation** For compromised service accounts: - **Access Key Disabling**: Immediately disable the compromised service account access key. - **New Key Generation**: After ensuring the old key is disabled, generate a new access key. ### **GSuite Admin Remediation** Admin accounts are crucial: - **Reset Password**: Resets the user password to halt any unauthorized access. - **Revoke Access Token**: Revoke any suspicious or unauthorized access tokens. - **Combo Action**: Reset the password and revoke access tokens to ensure complete safety. starttaskid: "0" tasks: "0": id: "0" taskid: 97236be9-5405-410e-8660-81f5ee7e9c65 type: start task: id: 97236be9-5405-410e-8660-81f5ee7e9c65 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "28" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1440, "y": -40 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: c2a274db-fb51-4049-8009-a7d72635685d type: regular task: id: c2a274db-fb51-4049-8009-a7d72635685d version: -1 name: List zone related instances description: Retrieves the list of instances contained within the specified zone. script: '|||gcp-compute-list-instances' type: regular iscommand: true brand: "" nexttasks: '#none#': - "6" scriptarguments: zone: complex: root: inputs.zone separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 55df6642-23fc-449f-88d5-41a87268aa33 type: regular task: id: 55df6642-23fc-449f-88d5-41a87268aa33 version: -1 name: Set possible compromised instances description: Set a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "9" scriptarguments: key: simple: possibleCompromisedInstances value: complex: root: GoogleCloudCompute.Instances filters: - - operator: isEqualString left: value: simple: GoogleCloudCompute.Instances.serviceAccounts.email iscontext: true right: value: simple: inputs.serviceAccountEmail iscontext: true ignorecase: true accessor: name separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: c8da559a-4bf0-45cb-80b5-2e12504ebc4c type: regular task: id: c8da559a-4bf0-45cb-80b5-2e12504ebc4c version: -1 name: Disable the SA access key description: Disables a service account key. script: '|||gcp-iam-service-account-key-disable' type: regular iscommand: true brand: "" nexttasks: '#none#': - "24" scriptarguments: key_name: complex: root: GCPIAM.ServiceAccountKey filters: - - operator: isEqualString left: value: simple: GCPIAM.ServiceAccountKey.keyType iscontext: true right: value: simple: USER_MANAGED ignorecase: true accessor: name separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 1380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: d53db53c-f69d-4637-833c-52d2f7793d45 type: title task: id: d53db53c-f69d-4637-833c-52d2f7793d45 version: -1 name: GCP IAM type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 760 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 938c214c-b12b-4385-8f6e-3e08bb17cdee type: title task: id: 938c214c-b12b-4385-8f6e-3e08bb17cdee version: -1 name: GSuite Admin type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "14" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2050, "y": 285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 583b9d1b-6b72-4016-8e0b-c74ec8a31949 type: regular task: id: 583b9d1b-6b72-4016-8e0b-c74ec8a31949 version: -1 name: Revoke access token description: Delete all access tokens issued by a user for an application. script: '|||gsuite-token-revoke' type: regular iscommand: true brand: GSuiteAdmin nexttasks: '#none#': - "22" scriptarguments: client_id: complex: root: inputs.clientID user_key: complex: root: inputs.userID separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2480, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 245d5d3a-a9c3-4e95-803a-d880242426bc type: regular task: id: 245d5d3a-a9c3-4e95-803a-d880242426bc version: -1 name: Reset password description: Updates a user. script: '|||gsuite-user-update' type: regular iscommand: true brand: "" nexttasks: '#none#': - "22" scriptarguments: password: complex: root: NEW_PASSWORD user_key: complex: root: inputs.userID separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2050, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 6f5cb0a9-73fa-41de-87f5-aed9d1ea4314 type: condition task: id: 6f5cb0a9-73fa-41de-87f5-aed9d1ea4314 version: -1 name: Check remediation type description: Checks the remediation type provided by the user. type: condition iscommand: false brand: "" nexttasks: '#default#': - "22" ALL: - "15" Reset Password: - "26" Revoke Access Key: - "11" separatecontext: false conditions: - label: Revoke Access Key condition: - - operator: isEqualString left: value: complex: root: inputs.GSuiteRemediationType iscontext: true right: value: simple: Revoke ignorecase: true - label: Reset Password condition: - - operator: isEqualString left: value: complex: root: inputs.GSuiteRemediationType iscontext: true right: value: simple: Reset ignorecase: true - label: ALL condition: - - operator: isEqualString left: value: complex: root: inputs.GSuiteRemediationType iscontext: true right: value: simple: ALL ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 2050, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: d286d49d-29f1-4ab2-84b5-ac4f184bf669 type: title task: id: d286d49d-29f1-4ab2-84b5-ac4f184bf669 version: -1 name: ALL type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "11" - "26" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2860, "y": 590 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 54427b29-32dc-4a4f-8fd9-1ba930a24f1e type: title task: id: 54427b29-32dc-4a4f-8fd9-1ba930a24f1e version: -1 name: IAM type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 285 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: e3137645-f549-499c-80f6-509fa3e2f549 type: title task: id: e3137645-f549-499c-80f6-509fa3e2f549 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1440, "y": 1710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: be4ec206-ae55-4e9f-8d22-4e85ccac6b12 type: regular task: id: be4ec206-ae55-4e9f-8d22-4e85ccac6b12 version: -1 name: Rotate the SA access key description: Creates a service account key. A service account can have up to 10 keys. Service account keys that you create don't have an expiry date and stay valid until you delete them. script: '|||gcp-iam-service-account-key-create' type: regular iscommand: true brand: "" nexttasks: '#none#': - "22" scriptarguments: key_algorithm: simple: KEY_ALG_RSA_2048 service_account_name: complex: root: GCPIAM.ServiceAccount filters: - - operator: isEqualString left: value: simple: GCPIAM.ServiceAccount.email iscontext: true right: value: simple: inputs.serviceAccountEmail iscontext: true ignorecase: true accessor: name transformers: - operator: FirstArrayElement separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 15988aab-f39b-434b-845d-67c5afd9dd42 type: regular task: id: 15988aab-f39b-434b-845d-67c5afd9dd42 version: -1 name: Get the service account keys description: 'Lists service account keys, or retrieves a specific service account key information. One of the arguments: ''service_account_name'' or ''key_name'' must be provided.' script: '|||gcp-iam-service-account-keys-get' type: regular iscommand: true brand: "" nexttasks: '#none#': - "7" scriptarguments: service_account_name: complex: root: GCPIAM.ServiceAccount filters: - - operator: isEqualString left: value: simple: GCPIAM.ServiceAccount.email iscontext: true right: value: simple: inputs.serviceAccountEmail iscontext: true accessor: name transformers: - operator: FirstArrayElement separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 1220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 1a01cfe3-cc5b-45f0-8ed2-61cf0d109676 type: regular task: id: 1a01cfe3-cc5b-45f0-8ed2-61cf0d109676 version: -1 name: Generate Password description: "This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of *random length* including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. \n\nThe min_* values all default to 0. This means that if the command is executed in this way:\n!GeneratePassword max_lcase=10\nIt is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches. \n\nThe debug parameter will print certain properties of the command into the WarRoom for easy diagnostics." scriptName: GeneratePassword type: regular iscommand: false brand: "" nexttasks: '#none#': - "13" scriptarguments: min_digits: simple: "5" min_lcase: simple: "5" min_symbols: simple: "1" min_ucase: simple: "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2050, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 7998e364-c06d-4c7e-8799-32d1ada7aa64 type: regular task: id: 7998e364-c06d-4c7e-8799-32d1ada7aa64 version: -1 name: List service accounts description: 'Lists service accounts in project, or retrieves a specific service accounts information. One of the arguments: ''service_account_name'' or ''project_name'' must be provided.' script: '|||gcp-iam-service-accounts-get' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: limit: simple: "100" project_name: complex: root: inputs.cloudProject separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 890, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: e4c0bc44-856f-48cd-85a9-b6e699dd8b17 type: condition task: id: e4c0bc44-856f-48cd-85a9-b6e699dd8b17 version: -1 name: Check identity type description: Checks the identity type that was part of the alert. type: condition iscommand: false brand: "" nexttasks: '#default#': - "22" SA: - "18" USER: - "10" separatecontext: false conditions: - label: SA condition: - - operator: isEqualString left: value: complex: root: inputs.identityType iscontext: true right: value: simple: SERVICE_ACCOUNT - - operator: isNotEmpty left: value: complex: root: inputs.zone iscontext: true - - operator: isNotEmpty left: value: complex: root: inputs.serviceAccountEmail iscontext: true - label: USER condition: - - operator: isEqualString left: value: complex: root: inputs.identityType iscontext: true right: value: simple: User ignorecase: true - - operator: isNotEmpty left: value: complex: root: inputs.userID iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1440, "y": 110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: a12c7ce8-164a-4b6f-8d46-41d0600e6ea3 type: condition task: id: a12c7ce8-164a-4b6f-8d46-41d0600e6ea3 version: -1 name: Was the service account retrieved in the previous task? description: Checks if the alerted service account is part of the 'service-accounts-get' response. type: condition iscommand: false brand: "" nexttasks: '#default#': - "22" "yes": - "25" separatecontext: false conditions: - label: "yes" condition: - - operator: containsString left: value: complex: root: GCPIAM.ServiceAccount accessor: email iscontext: true right: value: complex: root: inputs.serviceAccountEmail iscontext: true continueonerrortype: "" view: |- { "position": { "x": 890, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "14_11_Revoke Access Key": 0.77, "14_15_ALL": 0.33, "14_22_#default#": 0.21, "14_26_Reset Password": 0.59, "28_10_USER": 0.73, "28_18_SA": 0.68, "28_22_#default#": 0.1, "29_22_#default#": 0.37, "29_25_yes": 0.42 }, "paper": { "dimensions": { "height": 1815, "width": 2350, "x": 890, "y": -40 } } } inputs: - key: GSuiteRemediationType value: {} required: false description: |- The response playbook provides the following remediation actions using GSuite Admin: Reset: By entering "Reset" in the input, the playbook will execute password reset. Revoke: By entering "Revoke" in the input, the playbook will execute access key suspension. (Both the user and client IDs must be provided) ALL: By entering "ALL" in the input, the playbook will execute the password reset and revoke access key tasks. playbookInputQuery: - key: userID value: {} required: false description: Identifies the user in the API request. The value can be the user's primary email address, alias email address, or unique user ID. playbookInputQuery: - key: clientID value: {} required: false description: The client ID. playbookInputQuery: - key: zone value: {} required: false description: The name of the zone. playbookInputQuery: - key: serviceAccountEmail value: {} required: false description: The service account email. playbookInputQuery: - key: identityType value: {} required: false description: |- The type of identity involved. Usually mapped to the incident field named 'cloudidentitytype'. e.g. USER,SERVICE_ACCOUNT,APPLICATION playbookInputQuery: - key: cloudProject value: {} required: false description: The relevant project that the alert relates to. playbookInputQuery: outputs: - contextPath: GoogleCloudCompute.Instances description: Google Cloud Compute instance information. type: unknown - contextPath: GCPIAM.ServiceAccountKey description: The service account keys. type: unknown - contextPath: GCPIAM.ServiceAccount description: The service account information. type: unknown tests: - No tests (auto formatted) fromversion: 6.9.0