---
title: GKE Forbidden Creation Request
description: Detects denied GKE API create requests from non-control-plane identities. Failed creates can indicate RBAC probing, stolen credentials with insufficient...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_forbidden_creation_request
products:
  - Elastic Security
---

# GKE Forbidden Creation Request
Detects denied GKE API create requests from non-control-plane identities. Failed creates can indicate RBAC probing,
stolen credentials with insufficient privileges, or attempts to deploy unauthorized workloads.
**Rule type**: query
**Rule indices**:
- logs-gcp.audit-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: 100
**References**:
- [[https://kubernetes.io/docs/reference/access-authn-authz/rbac/](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
- [[https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging](https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging)](https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging)

**Tags**:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: GCP
- Data Source: Google Cloud Platform
- Use Case: Threat Detection
- Tactic: Execution
- Resources: Investigation Guide
- Noise: Medium
- Performance: Fast
- Rule Type: Custom Query (KQL)
- Platform: GCP
- Domain: Containers
- Platform: Kubernetes

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2
The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

## Investigation guide


## Triage and analysis


### Investigating GKE Forbidden Creation Request

Denied creates outside GKE system identities often reflect reconnaissance or misconfigured automation with stolen tokens.

### Investigation steps

- Review `client.user.email`, `event.action`, `gcp.audit.resource_name`, `source.ip`, `user_agent.original`, and `gcp.audit.status.message`.
- Determine whether the identity should exist and whether the target resource is sensitive (pods, secrets, RBAC).
- Correlate with later successful creates or RBAC changes from the same actor.


### False positives

- New deployments where RoleBindings lag the workload; exclude approved CI service accounts after review.


## Rule Query

```kuery
data_stream.dataset:gcp.audit and service.name:k8s.io and event.outcome:failure and
event.action:*.create and
gcp.audit.status.message:(*forbidden* or *Unauthorized*) and
not client.user.email:(
  "system:apiserver" or system\:kube-* or "system:cloud-controller-manager" or system\:gke-* or
  system\:node\:* or system\:serviceaccount\:kube-system\:* or system\:serviceaccount\:gke-managed* or
  "kubelet-bootstrap" or "kubelet-nodepool-bootstrap" or "gcp:kube-bootstrap"
) and
not user_agent.original:(*kubernetes/$Format)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)