Skip to content

Roles should not be assigned to default service accounts

Default Severity: medium

Explanation

Default service accounts should not be used - consider creating specialised service accounts for individual purposes.

Possible Impact

Violation of principal of least privilege

Suggested Resolution

Use specialised service accounts for specific purposes.

Insecure Example

The following example will fail the google-iam-no-project-level-default-service-account-assignment check. 

 resource "google_project_iam_member" "project-123" {
    project = "project-123"
    role    = "roles/whatever"
    member  = "123-compute@developer.gserviceaccount.com"
 }

Secure Example

The following example will pass the google-iam-no-project-level-default-service-account-assignment check. 

 resource "google_service_account" "test" {
    account_id   = "account123"
    display_name = "account123"
 }

 resource "google_project_iam_member" "project-123" {
    project = "project-123"
    role    = "roles/whatever"
    member  = "serviceAccount:${google_service_account.test.email}"
 }