Roles should not be assigned to default service accounts
Default service accounts should not be used - consider creating specialised service accounts for individual purposes.
Impact
Violation of principal of least privilege
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Use specialised service accounts for specific purposes.
1
2
3
4
5
6
7
8
9
10
11
|
resource "google_service_account" "test" {
account_id = "account123"
display_name = "account123"
}
resource "google_organization_iam_member" "org-123" {
org_id = "org-123"
role = "roles/whatever"
member = "serviceAccount:${google_service_account.test.email}"
}
|
Links