The Unauditable, Unmanageable HMAC Keys in Google Cloud by Kat Traxler

**TL;DR:** The report describes three vulnerabilities in Google Cloud's handling of user-associated HMAC keys—insufficient logging of key creation/deletion, absence of admin APIs and IAM controls to audit or revoke user HMAC keys, and long-lived unauditable credentials that can be used to SigV4-sign Cloud Storage requests for up to seven days—providing an attack scenario, PoC, recommendations, and a disclosure timeline where Google closed the issue as intended behavior.