No Org Level Service Account Impersonation | Vulnerability Database

Users should not be granted service account access at the organization level

Users with service account access at organization level can impersonate any service account. Instead, they should be given access to particular service accounts as required.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Provide access at the service-level instead of organization-level, if required

1
2
3
4


resource "google_organization_iam_binding" "organization-123" {
  org_id = "org-123"
  role   = "roles/nothingInParticular"
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam