Skip to content
Forestall

GWS_GROUP_MANAGER

Copy page

Summary
Forestall ACL Alias GWS_GROUP_MANAGER
GWS Alias Group Manager
Affected Object Types GWS Group
Exploitation Certainty Certain

Description

GWS_GROUP_MANAGER is a structural edge representing that an identity is a manager of a Google Workspace Group. Group managers occupy the second tier of group authority: they can add and remove members, approve membership requests, and promote existing members to MANAGER. A manager cannot assign the OWNER role, delete the group, or modify group-level settings.

If the group is bound to GCP IAM roles, a manager can add a controlled identity as a member to immediately inherit those permissions. The full escalation chain requires only a single API call: GWS_GROUP_MANAGER → GWS_ADD_GROUP_MEMBER → GCP IAM access.

Manager accounts are frequently overlooked during security reviews because alert policies typically focus on ownership changes. A manager foothold also persists through group ownership transfers — existing manager assignments are not automatically revoked when a group’s owner is changed or removed. If the target group is bound to organization-level or folder-level GCP IAM roles, a single manager foothold can yield access across every project in the organization.

Group membership changes by a manager are recorded only in Google Workspace audit logs. Member additions via the Groups UI route to the groups_enterprise stream; additions via the Admin API route to the admin stream. The GCP setIamPolicy event is never triggered.

Identification

gcloud CLI

# Find all GCP-bound groups across the organization
gcloud asset search-all-iam-policies \
    --scope='organizations/ORG_ID' \
    --query='memberTypes:group' \
    --format="table(resource, policy.bindings[].role, policy.bindings[].members)"
# List all members with MANAGER role in a group
GROUP_EMAIL="[email protected]"
gcloud identity groups memberships list \
  --group-email=$GROUP_EMAIL \
  --format="table(preferredMemberKey.id, roles[0].name)" \
  | grep MANAGER

Exploitation

# As a group manager, add attacker-controlled identity as member to inherit GCP IAM
GROUP_EMAIL="[email protected]"
gcloud identity groups memberships add \
  --group-email=$GROUP_EMAIL \
  [email protected] \
  --roles=MEMBER


# Wait 1-5 minutes for GCP IAM propagation
gcloud projects list
gcloud compute instances list --project=TARGET_PROJECT

Mitigation

  1. Convert GCP-bound groups to security groups — restricts all membership management to Super Admins only: 
    gcloud identity groups update GROUP_EMAIL \
      --labels=cloudidentity.googleapis.com/groups.security=''
  2. Minimize managers — assign the MANAGER role only when membership delegation is genuinely required. Audit and revoke unnecessary manager assignments regularly.
  3. Audit manager assignments on GCP-bound groups: 
    gcloud identity groups memberships list \
      --group-email=SENSITIVE_GROUP_EMAIL \
      --format="table(preferredMemberKey.id, roles[0].name)" | grep MANAGER
  4. Alert on manager-driven member additions on GCP-bound groups — specifically when the actor holds MANAGER (not OWNER or Admin), which is the operational signature of foothold exploitation.
  5. Enable GWS audit log export to Cloud Logging — without this, groups_enterprise additions (via Groups UI) are invisible to GCP-based monitoring.

Detection

Monitor group membership changes in Google Workspace Audit Logs. Pay attention to member additions performed by accounts that hold MANAGER rather than OWNER — these are the signature of manager foothold exploitation.

Google Admin Console

  1. Open Google Admin Console (admin.google.com) → Reporting → Audit and investigation → Groups Enterprise log events.
  2. Filter by Event Name: Add member or Update member (role change to MANAGER).
  3. Check the Actor field — if the actor holds MANAGER (not OWNER or Admin), the foothold is actively being exploited.

Cloud Logging (GCP)

# Monitor all group member additions and MANAGER role assignments
gcloud logging read \
  'logName="organizations/ORG_ID/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.serviceName="admin.googleapis.com" AND protoPayload.methodName="google.admin.AdminService.addGroupMember"' \
  --format="table(timestamp, protoPayload.authenticationInfo.principalEmail, protoPayload.request.groupKey, protoPayload.request.memberKey)"

References

Was this page helpful?

Thank you for your feedback.