Out of an abundance of caution, we recommend that organizations search for potential occurrences of the exploit technique, abnormal Service Account behavior, and consider rotating their Service Account user-managed keys. Google Cloud environments with data access logs enabled for ADMIN_READ activities on the Cloud Asset Inventory API will be able to search for potential instances of the particular exploitation attempt. Note that Google Cloud’s Security Command Center Premium features a number of built in detectors for anomalous behavior and sensitive actions that may detect any abnormal behavior stemming from this vulnerability.