Failed compute.instances.list operations missing authenticationInfo

7 views
Skip to first unread message

Lars Albertsson

unread,
Sep 13, 2021, 4:48:21 PMSep 13
to gce-dis...@googlegroups.com
What does it indicate when an audit log entry has empty authenticationInfo?

I am seeing a series of compute.instances.list requests, one for each
region. They lack authentication, and fail with PERMISSION_DENIED. I
have seen similar confusing log entries in the past caused by GCP
internal activities. Is it the case here as well, or should I suspect
a breach?


Lars Albertsson
Data engineering entrepreneur
www.scling.com
+46 70 7687109
https://twitter.com/lalleal, https://www.linkedin.com/in/larsalbertsson/
Reply all
Reply to author
Forward
0 new messages