Asset Key Thief

Asset Key Thief was a Google Cloud
privilege escalation vulnerability that enabled
principals with the "Cloud Asset Viewer" role (or other roles
with the `cloudasset.assets.searchAllResources` permission) on the
Cloud Asset Inventory API, at the Project, Folder, or Organization level
to view and exfiltrate any user-managed Service Account
private key under a project within the same Google Cloud environment that
had been created or rotated up to a maximum of 12 hours ago.
Access to Service Account private keys enable the …

access account api asset asset inventory assets attackers cloud enable environment escalation folder google google cloud identity inventory key keys managed organization permission private private key private keys privilege privilege escalation privileges project role roles service thief under viewer vulnerability