Cloud IAM Privilege Escalation

Config Connector turns namespace write access into roles/owner on a GCP organization

Justin O'Leary's ConfigConfusion technique turns on the fact that Google's Config Connector makes every cloud call with its own service account, so a tenant who can create one IAMPolicyMember inherits whatever that account is allowed to grant.