title: How do you find out who has impersonated the GCP Service account?
body: <p>I was working on a requirement wherein there is a need to know which user/machine has actually created the instances.</p>
  
  <p>For example if a Compute Instance has been created by a Service account, how do we come to know which user had created. Basically, the intention is if we could capture the IP address/MAC address to check for any security flaw ?</p>
  
  <p>Any hints are more than welcome !!!</p>