no-privileged-service-accounts
Default Severity: high
Explanation
Service accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account.
Possible Impact
Cloud account takeover if a resource using a service account is compromised
Suggested Resolution
Limit service account access to minimal required set
Insecure Example
The following example will fail the google-platform-no-privileged-service-accounts check.
resource "google_service_account" "test" {
account_id = "account123"
display_name = "account123"
}
resource "google_project_iam_member" "project" {
project = "your-project-id"
role = "roles/owner"
member = "serviceAccount:${google_service_account.test.email}"
}
Secure Example
The following example will pass the google-platform-no-privileged-service-accounts check.
resource "google_service_account" "test" {
account_id = "account123"
display_name = "account123"
}
resource "google_project_iam_member" "project" {
project = "your-project-id"
role = "roles/logging.logWriter"
member = "serviceAccount:${google_service_account.test.email}"
}