📝 Google GCE Instance is configured to use the Default Service Account with full access to all Cloud APIs 🟢

• Contextual name: 📝 Instance is configured to use the Default Service Account with full access to all Cloud APIs 🟢
• ID: /ce/ca/google/compute-engine/instance-use-default-service-account-with-full-access
• Located in: 📁 Google GCE

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Check for Instance-Associated Service Accounts with Full API Access

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Google GCE Instance
  • 🔌 Google GCE Instance ServiceAccount Link - object.extracts.yaml
  • 🔌 Google GCE Instance - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account Compute Engine default service account with Scope Allow full access to all Cloud APIs.

Rationale

Along with ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account Compute Engine default service account for an instances to access necessary cloud services. Project Editor role is assigned to Compute Engine default service account hence, This service account has almost all capabilities over all cloud services except billing. However, when Compute Engine default service account assigned to an instance it can operate in 3 scopes.

        1. Allow default access: Allows only minimum access required to run an Instance (Least Privileges) 
        2. Allow full access to all Cloud APIs: Allow full access to all the cloud APIs/Services (Too much access) 

... see more

Remediation

Open File

Remediation

From Google Cloud Console

1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.
2. Click on the impacted VM instance.
3. If the instance is not stopped, click the Stop button. Wait for the instance to be stopped.
4. Next, click the Edit button.
5. Scroll down to the Service Account section.
6. Select a different service account or ensure that Allow full access to all Cloud APIs is not selected.
7. Click the Save button to save your changes and then click START.

From Google Cloud CLI

1. Stop the instance:

        gcloud compute instances stop <INSTANCE_NAME>

2. Update the instance:

        gcloud compute instances set-service-account <INSTANCE_NAME> --service-account=<SERVICE_ACCOUNT> --scopes [SCOPE1, SCOPE2...]

3. Restart the instance:

        gcloud compute instances start <INSTANCE_NAME>

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS GCP v3.0.0 → 💼 4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs - Level 1 (Automated)			1
💼 Cloudaware Framework → 💼 Secure Access			43