CanEscalateTo

Forging a cert to act as a more-privileged identity is privilege escalation.

Signing with an HSM key that issues tokens/certs for a more-privileged identity is escalation.

Executing as a more-privileged Data Pipeline resourceRole or pipeline role is privilege escalation - an ACTIVE CanExecuteAs where the target role outranks the attacker.

Resetting the password of a domain-admin directory user yields privilege escalation to domain-admin access over all domain-joined resources.

Create a new role with admin trust + policy, then assume it.

Forging a signature for a more-privileged identity is privilege escalation.

Decrypting a KMS-encrypted secret whose credential is a more-privileged identity is privilege escalation.

Executing as a more-privileged Lambda role is privilege escalation.

A principal with es:UpdateDomainConfig on a FGAC-enabled domain can disable FGAC and grant all IAM-permitted principals cluster-admin data access.

PutResourcePolicy self-grants GetSecretValue on a secret that is credentials for a more-privileged identity - escalation.

Reading a secret that is credentials for a strictly-more-privileged identity is escalation.

Reading a SecureString that holds creds for a more-privileged identity is escalation.

Reading a secret that is a credential for a more-privileged identity is escalation.

A self-grant of a crypto role (via roleAssignments/write) is privilege escalation to key usage.

Executing as a strictly-more-privileged identity is escalation.

Impersonating a strictly-more-privileged identity is privilege escalation.

App Engine execution-as a more-privileged SA rolls up to an escalation edge.

CanExecuteAs a runtime SA of strictly greater privilege.

A principal with bigquery.datasets.setIamPolicy can self-grant roles/bigquery.dataOwner and escalate its data-plane privilege.

Forging a cert that impersonates a strictly more-privileged identity is escalation.

A principal who can reset the root DB user password and then read all data in a Cloud SQL instance has escalated to full DBA-level database privilege.

CanExecuteAs on a consumer's runtime SA of strictly greater privilege than the attacker, reached via an Eventarc trigger, is privilege escalation.

CanExecuteAs a runtime SA of strictly greater privilege.

Generating an HMAC key for a Service Account with greater GCS-scoped access and using it via the S3-compatible GCS API constitutes privilege escalation (storage-scoped only, not full SA impersonation).

A key manager self-granting crypto use gains the key's crypto capability.

Forging a signature as a key that anchors a more-privileged identity is escalation.

Reading a secret that yields credentials for a strictly more-privileged identity is escalation.