No Project Level Service Account Impersonation | Vulnerability Database

Users should not be granted service account access at the project level

Users with service account access at project level can impersonate any service account. Instead, they should be given access to particular service accounts as required.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Provide access at the service-level instead of project-level, if required

1
2
3
4


resource "google_project_iam_binding" "project-123" {
  project = "project-123"
  role    = "roles/nothingInParticular"
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam