Organization

cloudformation:CreateStackSet/UpdateStackSet with SERVICE_MANAGED permission model (Organizations integration) deploys to all Org member accounts - equivalent to organization-wide foothold.

Principal with cloudtrail:DeregisterOrganizationDelegatedAdmin can remove the delegated admin role from an account, preventing it from managing organization trails and reducing the security team's ability to respond to and restore logging. This is a persistence / evasion amplifier in multi-account environments.

Control Tower landing-zone administration is effectively organization administration.

Modifying organization-wide Detective configuration (UpdateOrganizationConfiguration, EnableOrganizationAdminAccount) weakens the org's investigative posture. Emits CanModifyConfiguration on the Organization scope.

A RAM share whose principal is the organization root (o-*) exposes the shared resource to every current and future member account in the organization - ExposedToTenant.

A shared subnet collapses the inter-account network boundary: consumer workloads launched into the shared subnet are on-link with owner-account resources, yielding on-subnet network reachability.

A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.

A dataset ACL entry for allAuthenticatedUsers makes it readable by any Google-authenticated user - org-wide or tenant-wide exposure.

A DWD SA with both admin-directory and cloud-platform scopes can act as a super-admin and thereby obtain GCP Organization-level control.

Firebase Security Rules requiring only 'request.auth != null' (authenticated but no domain/claim restriction) make the Firestore database accessible to any Firebase Auth user - including users outside the organization.

An IAM binding on a Firestore database naming 'allAuthenticatedUsers' allows access to any GCP-authenticated user, exposing data tenant-wide.

A bucket IAM binding granting any read role to allAuthenticatedUsers makes the bucket readable by any Google-authenticated user worldwide (not limited to the organization) - broad tenant-wide exposure including external Google accounts.

Principal with iam.denypolicies.update or .delete can remove/weaken a deny policy, upgrading the edges it was blocking.

Modify the project, folder, or org IAM policy's auditConfigs to remove DATA_READ/DATA_WRITE log types, suppressing Data Access audit log generation for targeted GCP services at the IAM policy level.

A snapshot with allAuthenticatedUsers or allUsers in its IAM policy is exposed to all GCP identities (authenticated or nominally public) across all projects/organizations.