GCP Incident report: Spotting an attacker in Google Cloud

TL;DR: Publicly exposed Google Cloud service account credentials in a public GitHub repository allowed an attacker (observed from a TOR exit node) to attempt creating a new service account key via the Google SDK; the attempt failed because the compromised service account lacked required IAM permissions and no further malicious activity was observed. Key takeaways: enforce least privilege, rotate keys regularly, and avoid storing credentials in code or repositories.