Google.Admin.Adminservice.Addgroupmember Remediation

Event Information

Event meaning & scope
- google.admin.AdminService.addGroupMember indicates a member (user, service account, or group) was added to a Google Group via the Admin SDK / Admin Console.
- In a GCPIAM context, this often means the subject gained indirect IAM permissions wherever that group is bound to IAM roles (projects, folders, org, or specific GCP resources).
Security & compliance implications
- This event can represent a privilege escalation if the group has high‑privilege roles (e.g., roles/owner, roles/editor, custom admin roles).
- For compliance frameworks (e.g., ISO 27001, SOC 2, PCI DSS), it is relevant to access control, least privilege, and auditability—track who added which identities to which groups and when.
Practical handling in GCP
- Monitor and alert on this event when the target group is mapped to sensitive IAM roles or production projects.
- Correlate with IAM bindings (Cloud Asset Inventory, gcloud asset or Organization Policy) to understand the effective new permissions granted.
- Periodically review groups with broad or privileged bindings and enforce approval workflows for membership changes.

Examples

Privilege escalation via high-privilege group
- google.admin.AdminService.addGroupMember adds a user/service account to an admin or privileged group (e.g., gcp-org-admins, project-owners).
- Impact: New member inherits broad IAM and possibly org-policy override rights; can create keys, modify logging, or disable security controls.
- Compliance: Violates least-privilege (ISO 27001 A.6, SOC 2 CC6, CIS GCP); must be justified, approved, and logged.
Circumventing access reviews and joiner/mover/leaver controls
- Member is added outside the standard HR/IT workflow, bypassing SoD and access review processes.
- Impact: Former employees, contractors, or external identities may retain or gain access to sensitive resources (e.g., production data, PHI/PII).
- Compliance: Conflicts with access recertification and termination controls (PCI DSS 7.2, HIPAA §164.308(a)(3), SOX access governance).
Unauthorized external collaboration / data exfiltration vector
- External identity (e.g., @gmail.com or partner domain) is added to a group mapped to GCP roles with data access (e.g., BigQuery datasets, GCS buckets).
- Impact: External party can read/export regulated or confidential data, potentially outside approved data residency or DLP boundaries.
- Compliance: Risks breach of data transfer, residency, and DLP requirements (GDPR, HIPAA, ISO 27018); must trigger alerting and review of group-to-IAM bindings.

Remediation

Using Console

Immediately contain and review the group membership change
- In Google Admin Console: go to Directory → Groups → [impacted group] → Members → identify the newly added member; if not explicitly authorized, Remove them.
- In GCP Console: go to IAM & Admin → IAM, filter by Principal = the added user/service account and review inherited roles from this group (especially roles/owner, roles/resourcemanager.organizationAdmin, custom high-privilege roles); remove any unintended bindings.
- Document the incident (who/when/why), map to violations of least-privilege and access controls (ISO 27001 A.6, SOC 2 CC6, CIS GCP, PCI DSS 7.2, HIPAA, SOX), and open a ticket/change record for formal approval/exception or permanent revocation.
Align group membership to joiner/mover/leaver and access review controls
- In Google Admin Console:
  - Under Security → Access and data control → Admin roles, restrict who can manage high-privilege groups (e.g., only a small “IAM-admin” role tied to IT security).
  - Under Rules (Security → Rules) create rules to alert on:
    - Condition: Group membership changed for specific privileged groups (e.g., GCP org/project admin groups).
    - Action: Send email/ webhook to security/IT and log to SIEM for SoD/access-review checks.
- In GCP Console:
  - Use IAM → Audit Logs (and Cloud Logging) to confirm google.admin.AdminService.addGroupMember and correlate with HR/IT workflows; ensure Admin Activity logs are routed to a central log project and retained per compliance.
  - Establish a periodic review (at least quarterly) of members of high-privilege groups and cross-check with HR roster and access recertification requirements (PCI DSS 7.2, HIPAA 164.308(a)(3), SOX).
Control external collaboration and data exfiltration via group-to-IAM bindings
- In Google Admin Console → Security → External access and Domain settings:
  - Restrict or disallow adding external members to sensitive groups; configure whitelists for trusted partner domains only.
  - Regularly review high-risk groups (mapped to BigQuery/GCS access) for members with external domains (@gmail.com, other external domains) and remove any unapproved accounts.
- In GCP Console:
  - Go to IAM & Admin → IAM, identify roles granted to these groups that provide data access (e.g., roles/storage.objectViewer, roles/bigquery.dataViewer, custom data roles) and tighten to least-privilege; remove group bindings where group membership includes externals without DPA/contract.
  - Configure Security → Data Loss Prevention and Cloud Logging → Log-based alerts to detect unusual BigQuery exports, GCS object downloads, or access from external identities, and review against GDPR/HIPAA/ISO 27018 data transfer and residency policies.

Using CLI

Immediately contain and validate high-privilege group change
- Identify the event and the affected group/member:
  - gcloud logging read 'protoPayload.methodName="google.admin.AdminService.addGroupMember"' --project=<LOGGING_PROJECT> --limit=50 --format=json
- List current members of the impacted high-privilege group (e.g., mapped Google Group → IAM):
  - gcloud identity groups memberships list --group-email=<GROUP_EMAIL> --format="table(name, preferredMemberKey.id, roles)"
- If the addition is not explicitly approved via your access workflow, remove the member and document the incident:
  - gcloud identity groups memberships delete <MEMBERSHIP_NAME> --group-email=<GROUP_EMAIL>
Reinforce least-privilege, SoD, and access review controls
- Discover which groups are mapped to high-privilege IAM roles and review for inappropriate members (internal and external):
  - gcloud projects get-iam-policy <PROJECT_ID> --format=json | jq '.bindings[] | select(.role|test("owner|admin|OrgAdmin"; "i"))'
  - gcloud iam roles list --organization=<ORG_ID> --format="value(name)" | grep -Ei 'admin|owner|security|orgPolicy'
- Enforce centralized, ticket-based access with time-bound membership for admin groups (e.g., using Access Approval / PAM):
  - Where feasible, replace static membership with short-lived IAM conditions:
    - gcloud projects add-iam-policy-binding <PROJECT_ID> --member="group:<GROUP_EMAIL>" --role="roles/resourcemanager.projectIamAdmin" --condition='expression=request.time < timestamp("2026-07-31T00:00:00Z"),title=TimeBoundAccess'
- Align with ISO 27001 A.6, SOC 2 CC6, CIS GCP, PCI DSS 7.2 by integrating HR/IT workflows and periodic recertification of all high-privilege groups.
Control external identities and data access / exfiltration risk
- Enumerate external members of groups bound to data-access roles (BQ/GCS) and remove or justify them:
  - Find IAM bindings to groups for data roles:
    - gcloud projects get-iam-policy <PROJECT_ID> --format=json | jq '.bindings[] | select(.role|test("bigquery|storage.objectViewer|storage.objectAdmin"; "i"))'
  - List group memberships and filter for non-corporate domains:
    - gcloud identity groups memberships list --group-email=<GROUP_EMAIL> --format=json | jq '.[] | select(.preferredMemberKey.id|test("@gmail.com$|@yahoo.com$|@outlook.com$"))'
  - Remove any unapproved external member and log rationale:
    - gcloud identity groups memberships delete <MEMBERSHIP_NAME> --group-email=<GROUP_EMAIL>
- Review and, if necessary, tighten group-to-IAM bindings on BigQuery datasets and GCS buckets to comply with GDPR/HIPAA/ISO 27018:
  - bq show --format=prettyjson <PROJECT_ID>:<DATASET> | jq '.access'
  - gsutil iam get gs://<BUCKET_NAME> | jq '.bindings'
- Configure alerts on google.admin.AdminService.addGroupMember events and on IAM changes involving external principals; ensure DLP and data residency controls are applied to any resource accessible by these groups.

Using Python

Detect and review high-privilege group additions (GCPIAM / Admin SDK)

Use Cloud Logging + Python to detect google.admin.AdminService.addGroupMember events on sensitive groups (e.g., gcp-org-admins, project-owners, groups mapped to roles/owner, roles/resourcemanager.organizationAdmin), then auto-flag for review and optionally auto-remove if not approved:

from google.cloud import logging_v2
import json, re, datetime as dt

HIGH_PRIV_GROUP_PATTERNS = [
    r'gcp-org-admins@', r'project-owners@', r'org-admins@',
    r'security-admins@', r'prod-admins@'
]

def is_high_priv_group(email: str) -> bool:
    return any(re.search(p, email, re.IGNORECASE) for p in HIGH_PRIV_GROUP_PATTERNS)

def list_recent_addGroupMember(project_id: str, minutes: int = 15):
    client = logging_v2.Client(project=project_id)
    now = dt.datetime.utcnow()
    start = now - dt.timedelta(minutes=minutes)
    filter_ = (
        'protoPayload.methodName="google.admin.AdminService.addGroupMember" '
        f'timestamp>="{start.isoformat("T")}Z"'
    )
    for entry in client.list_entries(filter_=filter_):
        payload = entry.payload
        if "protoPayload" in payload:
            pp = payload["protoPayload"]
        else:
            pp = payload
        params = pp.get("request", {})
        group_email = params.get("group", {}).get("email") or params.get("groupKey", {}).get("id")
        member_email = params.get("memberKey", {}).get("id")
        actor = pp.get("authenticationInfo", {}).get("principalEmail")
        if group_email and is_high_priv_group(group_email):
            yield {
                "group": group_email,
                "member": member_email,
                "actor": actor,
                "insertId": pp.get("insertId", entry.insert_id),
                "timestamp": entry.timestamp
            }

if __name__ == "__main__":
    for ev in list_recent_addGroupMember("YOUR_LOGGING_PROJECT_ID"):
        print("HIGH-PRIV GROUP CHANGE:", ev)
        # Integrate with ticketing / approval workflows to meet ISO27001/SOC2/CIS

Tie this to a manual approval workflow (e.g., ticket ID in description) and retain logs for PCI/SOX/HIPAA evidence; only changes with valid change tickets should persist.

Enforce JML (Joiner/Mover/Leaver) and SoD controls via group / IAM reconciliation

Periodically reconcile group membership with HR/IdP authoritative sources; auto-remove members no longer in “active” employment or approved roles:

from google.oauth2 import service_account
from googleapiclient.discovery import build

SCOPES = ['https://www.googleapis.com/auth/admin.directory.group.readonly',
          'https://www.googleapis.com/auth/admin.directory.group.member']

def get_directory_service(sa_file: str, admin_user: str):
    creds = service_account.Credentials.from_service_account_file(
        sa_file, scopes=SCOPES
    ).with_subject(admin_user)
    return build('admin', 'directory_v1', credentials=creds)

def cleanup_group_members(group_email: str, allowed_members: set, service):
    members = service.members().list(groupKey=group_email).execute().get('members', [])
    for m in members:
        email = m['email']
        if email not in allowed_members:
            print(f"Removing unauthorized member {email} from {group_email}")
            service.members().delete(groupKey=group_email, memberKey=email).execute()

if __name__ == "__main__":
    svc = get_directory_service("svc-account.json", "admin@your-domain.com")
    # allowed_members should come from HR/IdP export to satisfy PCI 7.2 / HIPAA / SOX
    allowed_members = {"alice@corp.com", "bob@corp.com"}
    cleanup_group_members("gcp-org-admins@your-domain.com", allowed_members, svc)

Run this as a scheduled job (Cloud Scheduler + Cloud Run/Functions) to enforce access recertification, SoD, and leaver removal.

Detect and remediate external identities & data-exposure risk

Identify external members (@gmail.com, non-corporate domains) on groups mapped to GCP IAM bindings with data access (BigQuery/GCS), then either remove or downgrade them; log for GDPR/ISO 27018 review:

from googleapiclient.discovery import build
from google.oauth2 import service_account

CORP_DOMAINS = ["your-domain.com", "trusted-partner.com"]

def is_external(email: str) -> bool:
    domain = email.split("@")[-1].lower()
    return domain not in [d.lower() for d in CORP_DOMAINS]

def list_group_members(service, group_email: str):
    req = service.members().list(groupKey=group_email)
    while req is not None:
        res = req.execute()
        for m in res.get('members', []):
            yield m
        req = service.members().list_next(req, res)

def remove_external_from_group(service, group_email: str):
    for m in list_group_members(service, group_email):
        email = m['email']
        if is_external(email):
            print(f"External member {email} found in {group_email}, removing to reduce exfil risk")
            service.members().delete(groupKey=group_email, memberKey=email).execute()

if __name__ == "__main__":
    svc = get_directory_service("svc-account.json", "admin@your-domain.com")
    sensitive_groups = [
        "bq-prod-readers@your-domain.com",
        "gcs-phi-access@your-domain.com"
    ]
    for g in sensitive_groups:
        remove_external_from_group(svc, g)

Combine with an IAM inventory (e.g., Cloud Asset Inventory export) to list group-to-IAM bindings for BigQuery datasets and GCS buckets, then trigger alerts when external identities are detected on those groups to support DLP/data residency requirements.

Event Information​

Examples​

Remediation​

Using Console​

Using CLI​

Using Python​