Google > Iam >

No Project Level Default Service Account Assignment

MEDIUM
Source
Trivy
ID
AVD-GCP-0006

Roles should not be assigned to default service accounts

Default service accounts should not be used - consider creating specialised service accounts for individual purposes.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Use specialised service accounts for specific purposes.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
resource "google_service_account" "test" {
  account_id   = "account123"
  display_name = "account123"
}

resource "google_project_iam_member" "project-123" {
  project = "project-123"
  role    = "roles/whatever"
  member  = "serviceAccount:${google_service_account.test.email}"
}