Roles should not be assigned to default service accounts
Default service accounts should not be used - consider creating specialised service accounts for individual purposes.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Use specialised service accounts for specific purposes.
1
2
3
4
5
6
7
8
9
10
|
resource "google_service_account" "test" {
account_id = "account123"
display_name = "account123"
}
resource "google_organization_iam_member" "org-123" {
org_id = "org-123"
role = "roles/whatever"
member = "serviceAccount:${google_service_account.test.email}"
}
|