No Privileged Service Accounts | Vulnerability Database

Service accounts should not have roles assigned with excessive privileges

Service accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Limit service account access to minimal required set

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


resource "google_service_account" "test" {
  account_id   = "account123"
  display_name = "account123"
  email        = "jim@tfsec.dev"
}

resource "google_project_iam_member" "project" {
  project = "your-project-id"
  role    = "roles/logging.logWriter"
  member  = "serviceAccount:${google_service_account.test.email}"
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam