Check Details

• Resource: Integration
• Check: Restrict Admin Privileges on Service Accounts
• Risk: Service accounts with Admin, Editor, or Owner roles can make unrestricted changes to GCP resources, increasing the impact of credential compromise.

Remediation via Google Cloud Console

1. Go to IAM & Admin → IAM using Google Cloud Console .
2. Under the IAM tab, select View by principals.
3. Filter Principals by type: Service account.
4. Identify user-created service accounts with the principal format:
   SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com
5. In the Role column, look for roles containing:
   • *Admin or *admin
   • roles/editor
   • roles/owner
   
6. Click the Edit (pencil icon) for the service account to view all assigned roles.
7. Click the Delete (bin) icon to remove the administrative role from the service account.

Remediation via Google Cloud CLI

1. Open the Google Cloud Console and launch Cloud Shell.
2. Export the project IAM policy to a JSON file:

   
   gcloud projects get-iam-policy PROJECT_ID --format=json > iam.json
   

3. Open iam.json in a text editor and remove any roles that contain:
   • roles/*Admin or roles/*admin
   • roles/editor
   • roles/owner
4. Add a new role to the bindings array to assign a least-privilege role to the service account.
5. Example policy update:

   
   
   
   {
   "bindings": [
   {
   "members": [
   "serviceAccount:our-project-123@appspot.gserviceaccount.com"
   ],
   "role": "roles/appengine.appViewer"
   },
   {
   "members": [
   "user:email1@gmail.com"
   ],
   "role": "roles/owner"
   },
   {
   "members": [
   "serviceAccount:our-project-123@appspot.gserviceaccount.com",
   "serviceAccount:123456789012-compute@developer.gserviceaccount.com"
   ],
   "role": "roles/editor"
   }
   ],
   "etag": "BwUjMhCsNvY="
   }
   
   

6. Apply the updated IAM policy:

   
   
   gcloud projects set-iam-policy PROJECT_ID iam.json
   

Default Value

User-managed default service accounts may have the roles/editor role assigned to support GCP services. By default, no roles are assigned to user-created service accounts unless explicitly granted.