No User Granted Permissions | Vulnerability Database

IAM granted directly to user.

Permissions should not be directly granted to users, you identify roles that contain the appropriate permissions, and then grant those roles to the user.

Granting permissions to users quickly become unwieldy and complex to make large scale changes to remove access to a particular resource.

Permissions should be granted on roles, groups, services accounts instead.

Impact

Users shouldn’t have permissions granted to them directly

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Roles should be granted permissions and assigned to users

1
2
3
4
5
6
7
8
9


 resource "google_project_iam_binding" "good_example" {
 	members = [
 		"group:test@example.com",
 		]
 }
 
 resource "google_storage_bucket_iam_member" "good_example" {
 	member = "serviceAccount:test@example.com"
 }

Remediation Links

https://www.terraform.io/docs/providers/google/d/iam_policy.html#members