IAM Service Account Credentials
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| any | Catch-all entry for iamcredentials.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation. | activity | N | N |
| GenerateAccessToken | data_access | Y | Y | |
| GenerateIdToken | activity | N | N | |
| SignBlob | activity | N | N | |
| SignJwt | activity | N | Y |
any: iamcredentials.googleapis.com (any method)
#Description
Catch-all entry for iamcredentials.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.
GenerateAccessToken
#Data Access audit logs are disabled by default. Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"insertId": "ibx0iee6cdv0",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"operation": {
"first": true,
"id": "4085146214715229789",
"last": true,
"producer": "iamcredentials.googleapis.com"
},
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
}
},
"authorizationInfo": [
{
"granted": false,
"permission": "iam.serviceAccounts.getAccessToken",
"permissionType": "ADMIN_READ",
"resourceAttributes": {}
}
],
"metadata": {
"identityDelegationChain": [
"projects/-/serviceAccounts/dwgen-dw739065@example-project-id.iam.gserviceaccount.com"
]
},
"methodName": "GenerateAccessToken",
"request": {
"@type": "type.googleapis.com/google.iam.credentials.v1.GenerateAccessTokenRequest",
"name": "projects/-/serviceAccounts/dwgen-dw739065@example-project-id.iam.gserviceaccount.com"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.auth.print-access-token invocation-id/e917eebce171441fb21dd54c5c6dc372 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T13:19:32.246808769Z"
}
},
"resourceName": "projects/-/serviceAccounts/100186808964833041985",
"serviceName": "iamcredentials.googleapis.com",
"status": {
"code": 7,
"message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist)."
}
},
"receiveTimestamp": "2026-06-29T13:19:32.734614302Z",
"resource": {
"labels": {
"email_id": "dwgen-dw739065@example-project-id.iam.gserviceaccount.com",
"project_id": "example-project-id",
"unique_id": "100186808964833041985"
},
"type": "service_account"
},
"severity": "ERROR",
"timestamp": "2026-06-29T13:19:32.233194498Z"
}
Common Indicators #
Field Kind Value Rules Vendors result (kusto rule field)eq true1 rule kusto Detection Rules #
Kusto #
T1550
GenerateIdToken
#SignBlob
#SignJwt
#Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
protoPayload.authorizationInfo (panther rule field) | is_not_null | | 1 rule | panther |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Panther #
T1548