> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/gcp/gws_in_group.md).

# GWS\_IN\_GROUP

## Summary

|                            |                                 |
| -------------------------- | ------------------------------- |
| **FSProtect ACL Alias**    | GWS\_IN\_GROUP                  |
| **GCP Alias**              | Entity Relation (Structural)    |
| **Affected Object Types**  | Users, Service Accounts, Groups |
| **Exploitation Certainty** | Certain                         |

## Description

`GWS_IN_GROUP` is a structural edge representing that a GCP identity (user or service account) is a **member of a Google Group**. Google Groups are used in GCP IAM as a way to grant roles to many identities at once — instead of binding a role directly to each user, a role is bound to a group, and all group members inherit the permissions.

**Key properties:**

* A single identity can be a member of multiple groups.
* Group membership is managed in **Google Workspace** (or Cloud Identity), not directly in GCP IAM — it is not visible in the GCP IAM console by default.
* Groups can be nested: a group can be a member of another group, creating transitive membership chains.
* External users (Gmail addresses, federated identities) can be added to Google Groups.

## Identification

### GCP Console

1. Open **Google Admin Console** (`admin.google.com`) → **Directory** → **Groups**.
2. Search for groups with GCP IAM bindings.
3. Review group membership — any member inherits all GCP IAM roles bound to the group.
4. In **GCP Console** → **IAM & Admin** → **IAM**, group bindings appear as `Group` under `Type` column.

### gcloud CLI

```bash
# List all members of a specific group
GROUP_EMAIL="engineering-team@example.com"
gcloud identity groups memberships list \
  --group-email=$GROUP_EMAIL \
  --format="table(preferredMemberKey.id, roles[0].name)"
```

## Exploitation

There is no direct exploit path for this edge. `GWS_IN_GROUP` indicates that an identity is a member of a group, representing a relationship rather than an exploitable permission. The privileges inherited through group membership depend on what permissions are assigned to that group.

## Mitigation

No specific mitigation is required for this edge, as it represents a membership relationship. However, organizations should regularly audit group memberships to ensure only authorized identities are members of sensitive groups.

## Detection

Detect group membership changes in audit logs.

1. Open **Google Admin Console** (`admin.google.com`) → **Groups Enterprise Log Events** → **Group Enterprise Log Events**.
2. Look for membership changes for groups.

Alert on:

* External member addition to a group that holds GCP IAM roles.
* Group membership changes for groups with IAM bindings.
* Membership additions outside business hours or from unexpected admin accounts.

## References

* <https://cloud.google.com/iam/docs/groups-in-cloud-console>