Check Details

• Resource: Compute Engine
• Check: Restrict default service account usage
• Risk: The default Compute Engine service account has broad permissions that may allow privilege escalation and unauthorized access to GCP resources.

Remediation via Google Cloud Console

1. Log in to the Google Cloud Console and navigate to Compute Engine → VM instances.
2. Click on the affected VM instance name to open the instance details page.
3. Click STOP to stop the instance, then click EDIT.
4. Scroll to the API and identity management section and select a custom service account instead of the default Compute Engine service account.
5. Click Save, then click START to restart the instance.

Remediation via Google Cloud CLI

1. Open the Google Cloud Console and click the Cloud Shell icon (>_) in the top-right corner.
2. Stop the VM instance:

   
   gcloud compute instances stop <INSTANCE_NAME>
   

   
3. Update the instance to use a custom service account:

   
   gcloud compute instances set-service-account <INSTANCE_NAME> \
    --service-account=<SERVICE_ACCOUNT>
   

   
4. Restart the VM instance:

   
   gcloud compute instances start <INSTANCE_NAME>
   

Replace <INSTANCE_NAME> with the VM instance name and <SERVICE_ACCOUNT> with the custom service account email.

Default Value

By default, Compute Engine VM instances are configured to use the default Compute Engine service account.