Google > Iam >

No Org Level Default Service Account Assignment

MEDIUM
Source
Trivy/CSPM
CSPM ID
service-account-separation
ID
AVD-GCP-0008

Roles should not be assigned to default service accounts

Default service accounts should not be used - consider creating specialised service accounts for individual purposes.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Use specialised service accounts for specific purposes.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
resource "google_service_account" "test" {
  account_id   = "account123"
  display_name = "account123"
}

resource "google_organization_iam_member" "org-123" {
  org_id = "org-123"
  role   = "roles/whatever"
  member = "serviceAccount:${google_service_account.test.email}"
}