Loading

GKE Forbidden Creation Request

Detects denied GKE API create requests from non-control-plane identities. Failed creates can indicate RBAC probing, stolen credentials with insufficient privileges, or attempts to deploy unauthorized workloads.

Rule type: query
Rule indices:

  • logs-gcp.audit-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-6m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Domain: Kubernetes
  • Data Source: GCP
  • Data Source: Google Cloud Platform
  • Use Case: Threat Detection
  • Tactic: Execution
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2
The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

Denied creates outside GKE system identities often reflect reconnaissance or misconfigured automation with stolen tokens.

  • Review client.user.email, event.action, gcp.audit.resource_name, source.ip, user_agent.original, and gcp.audit.status.message.
  • Determine whether the identity should exist and whether the target resource is sensitive (pods, secrets, RBAC).
  • Correlate with later successful creates or RBAC changes from the same actor.
  • New deployments where RoleBindings lag the workload; exclude approved CI service accounts after review.
data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
event.action:*.create and
gcp.audit.status.message:(*forbidden* or *Unauthorized*) and
not client.user.email:(
  "system:apiserver" or system\:kube-* or "system:cloud-controller-manager" or system\:gke-* or
  system\:node\:* or system\:serviceaccount\:kube-system\:* or system\:serviceaccount\:gke-managed* or
  "kubelet-bootstrap" or "kubelet-nodepool-bootstrap" or "gcp:kube-bootstrap"
) and
not user_agent.original:(*kubernetes/$Format)

Framework: MITRE ATT&CK