MEDIUM
Source
Trivy
ID
AVD-GCP-0050

Checks for service account defined for GKE nodes

You should create and use a minimally privileged service account to run your GKE cluster instead of using the Compute Engine default service account.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Use limited permissions for service accounts to be effective

1
2
3
4
5
resource "google_container_cluster" "good_example" {
  node_config {
    service_account = "cool-service-account@example.com"
  }
}