# Resource name impersonation via missing match

Backend trusts a name, tag, or ID it never verifies against the caller's identity or true owner

_Area: Cloud and container security. Seen in 5 disclosed reports; 5 confirmed bounties, median $3,134, range $500-$7,500; latest 2022-06-02. Updated 2026-10-25._

## How it works
A backend creates, selects, or updates a resource by a name, tag, or identifier it never checks against the caller's identity or the resource's real owner. The broken assumption: that a name or tag uniquely and safely identifies the intended resource. When the name is predictable or the tag is attacker-writable, an attacker pre-creates or shadows the resource, and the platform then trusts it as its own.

## Where it shows up
- Resource names derived from public identifiers (project ID, location) that anyone can register [E3](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979.md)[E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168987557.md)
- Backend writes to a bucket or storage location without verifying ownership [E3](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979.md)[E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168987557.md)
- Controllers selecting resources by tags rather than a stored ID [E2](https://bugbountylibrary.com/r/h1%3A1238017.md)[E5](https://bugbountylibrary.com/r/h1%3A1238482.md)
- Creation paths that skip name-equality checks on hidden or legacy parameters [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md)
- Ownership decided by tag values any principal in the account can write [E5](https://bugbountylibrary.com/r/h1%3A1238482.md)

## How to review
Check the exact invariant: before acting on a resource, confirm its canonical identity (owner account, stored ID, or exact normalized name) matches the expected one. For creation, verify the name equals the config name after canonicalization [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md). For selection, require a stored ID, not a tag or first-match [E2](https://bugbountylibrary.com/r/h1%3A1238017.md)[E5](https://bugbountylibrary.com/r/h1%3A1238482.md). For writes, verify bucket ownership before trusting contents [E3](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979.md)[E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168987557.md). Ask whether a lower-privileged principal can create or tag a resource that satisfies the same check.

## Variants seen
- Missing serviceName/serviceConfig.name match on creation, letting attacker impersonate other services [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md)
- Tag-based SG selection picks lower-ID attacker resource and deletes the legit one [E2](https://bugbountylibrary.com/r/h1%3A1238017.md)
- Predictable bucket name squatted for cross-tenant code read/backdoor [E3](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979.md)
- Predictable scratch bucket squatted for RCE via startup scripts [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168987557.md)
- Attacker-taggable SG treated as controller-owned and rewritten [E5](https://bugbountylibrary.com/r/h1%3A1238482.md)

## Impact and severity
Led to cross-tenant code execution [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168987557.md), victim code backdooring [E3](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979.md), full port exposure [E2](https://bugbountylibrary.com/r/h1%3A1238017.md), arbitrary SG rule injection [E5](https://bugbountylibrary.com/r/h1%3A1238482.md), and private API enablement plus service disruption [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md). Severity rises when the attacker needs only low privilege (namespace access, tag write) or public identifiers, and when the platform auto-selects the shadowed resource without human review.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-75k-google-services-mix-up-html.md
- E2: https://bugbountylibrary.com/r/h1%3A1238017.md
- E3: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979.md
- E4: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168987557.md
- E5: https://bugbountylibrary.com/r/h1%3A1238482.md