Ensure that service accounts are not granted with permissions to use other service accounts or set iam policies

In case of a compromised service account, an attacker would be able to make lateral movement easily. Therefore you should avoid giving a service account permissions to use other service accounts or to set iam policies.

Suggest Edits

Risk Level: High
Cloud Entity: Service Account
CloudGuard Rule ID: D9.GCP.IAM.11
Covered by Spectral: Yes
Category: Security, Identity, & Compliance

GSL LOGIC

ServiceAccount should not have roles contain-any [ $ like 'roles/iam.serviceAccount%' ] or roles contain-any [ $ like 'roles/iam.securityAdmin' ]

REMEDIATION

From Portal

Go to IAM & admin/IAM using https://console.cloud.google.com/iam-admin/iam
Go to the Members
Identify the service account with over-permissive roles, click on the edit member icon.
Identify the over-permissive roles and click on the delete bin icon to remove role from the service account.

From Command Line

Get the policy that you want to modify, and write it to a yaml file, Run:

gcloud projects get-iam-policy PROJECT_ID  PATH_TO_NEWLY_CREATED_FILE

In the created yaml, detect the overly permissive service account and delete any role containing 'roles/iam.serviceAccount' or 'roles/iam.securityAdmin'
Set the new iam policy of the service account:

gcloud projects set-iam-policy PROJECT_ID PATH_TO_EDITED_FILE

References

Service Account

A service account is an account that belongs to your application instead of an individual end user. When you run code that is hosted on GCP, you specify the account that the code should run as. You can create as many service accounts as needed to represent the different logical components of your application.

Compliance Frameworks

CloudGuard GCP All Rules Ruleset
GCP CloudGuard Best Practices
GCP GDPR Readiness
GCP LGPD regulation
GCP MITRE ATT&CK Framework v12.1
GCP NIST 800-53 Rev 5

Updated over 1 year ago