---
names: 
  full: "Google IAM Users are assigned the Service Account User or Service Account Token Creator roles at Project level"
  contextual: "IAM Users are assigned the Service Account User or Service Account Token Creator roles at Project level"
description: "It is recommended to assign the Service Account User (iam.serviceAccountUser) and \
  Service Account Token Creator (iam.serviceAccountTokenCreator) roles to a user \
  for a specific service account rather than assigning the role to a user at project level."
type: COMPLIANCE_POLICY
categories:
  - "SECURITY"
frameworkMappings:
  - /frameworks/cis-gcp-v3.0.0/01/06
  - /frameworks/cloudaware/identity-and-access-governance/rbac-management
similarPolicies:
  cloudConformity:
    - url: "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudIAM/check-for-iam-users-with-service-roles.html"
      name: "Check for IAM Members with Service Roles at the Project Level"
 