# GCP - IAM Post Exploitation

{{#include ../../../banners/hacktricks-training.md}}

## IAM <a href="#service-account-impersonation" id="service-account-impersonation"></a>

You can find further information about IAM in:

{{#ref}}
../gcp-services/gcp-iam-and-org-policies-enum.md
{{#endref}}

### Granting access to management console <a href="#granting-access-to-management-console" id="granting-access-to-management-console"></a>

Access to the [GCP management console](https://console.cloud.google.com) is **provided to user accounts, not service accounts**. To log in to the web interface, you can **grant access to a Google account** that you control. This can be a generic "**@gmail.com**" account, it does **not have to be a member of the target organization**.

To **grant** the primitive role of **Owner** to a generic "@gmail.com" account, though, you'll need to **use the web console**. `gcloud` will error out if you try to grant it a permission above Editor.

You can use the following command to **grant a user the primitive role of Editor** to your existing project:

```bash
gcloud projects add-iam-policy-binding [PROJECT] --member user:[EMAIL] --role roles/editor
```

If you succeeded here, try **accessing the web interface** and exploring from there.

This is the **highest level you can assign using the gcloud tool**.

{{#include ../../../banners/hacktricks-training.md}}



