Skip to main content

🛡️ Google GCE Instance is configured to use the Default Service Account with full access to all Cloud APIs🟢

  • Contextual name: 🛡️ Instance is configured to use the Default Service Account with full access to all Cloud APIs🟢
  • ID: /ce/ca/google/compute-engine/instance-use-default-service-account-with-full-access
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account Compute Engine default service account with Scope Allow full access to all Cloud APIs.

Rationale​

Along with ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account Compute Engine default service account for an instances to access necessary cloud services. Project Editor role is assigned to Compute Engine default service account hence, This service account has almost all capabilities over all cloud services except billing. However, when Compute Engine default service account assigned to an instance it can operate in 3 scopes.

        1. Allow default access: Allows only minimum access required to run an Instance (Least Privileges) 
        2. Allow full access to all Cloud APIs: Allow full access to all the cloud APIs/Services (Too much access)

... see more

Remediation​

Open File

Remediation​

From Google Cloud Console​

  1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.
  2. Click on the impacted VM instance.
  3. If the instance is not stopped, click the Stop button. Wait for the instance to be stopped.
  4. Next, click the Edit button.
  5. Scroll down to the Service Account section.
  6. Select a different service account or ensure that Allow full access to all Cloud APIs is not selected.
  7. Click the Save button to save your changes and then click START.

From Google Cloud CLI​

  1. Stop the instance:

         gcloud compute instances stop <INSTANCE_NAME>

  2. Update the instance:

         gcloud compute instances set-service-account <INSTANCE_NAME> --service-account=<SERVICE_ACCOUNT> --scopes [SCOPE1, SCOPE2...]

  3. Restart the instance:

         gcloud compute instances start <INSTANCE_NAME>

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS GCP v1.2.0 → 💼 4.2 Ensure that instances are not configured to use the default service account with full access to all Cloud APIs - Level 1 (Automated)1no data
💼 CIS GCP v1.3.0 → 💼 4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs - Level 1 (Automated)1no data
💼 CIS GCP v2.0.0 → 💼 4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs - Level 1 (Automated)1no data
💼 CIS GCP v3.0.0 → 💼 4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs - Level 1 (Automated)1no data
💼 Cloudaware Framework → 💼 Secure Access57no data
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)61432no data
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)132no data
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)432no data
💼 ISO/IEC 27001:2013 → 💼 A.9.2.3 Management of privileged access rights312no data
💼 ISO/IEC 27001:2022 → 💼 8.2 Privileged access rights710no data
💼 ISO/IEC 27001:2022 → 💼 8.9 Configuration management12no data
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes1934no data
💼 NIST CSF v1.1 → 💼 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties1756no data
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented4791no data
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization42no data
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated53no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties116no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected148no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected125no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected142no data
💼 NIST SP 800-53 Revision 4 → 💼 AC-6 LEAST PRIVILEGE1027no data
💼 NIST SP 800-53 Revision 5 → 💼 IA-5 Authenticator Management1816no data
💼 PCI DSS v3.2.1 → 💼 2.1 Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network.19no data
💼 PCI DSS v3.2.1 → 💼 2.1.1 For wireless environments connected to the cardholder data environment or transmitting cardholder data, change ALL wireless vendor defaults at installation, including but not limited to default wireless encryption keys, passwords, and SNMP community strings.2no data
💼 PCI DSS v3.2.1 → 💼 7.1.2 Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities.5no data
💼 PCI DSS v3.2.1 → 💼 7.1.3 Assign access based on individual personnel's job classification and function.5no data
💼 PCI DSS v4.0.1 → 💼 2.2.2 Vendor default accounts are managed.9no data
💼 PCI DSS v4.0.1 → 💼 2.3.1 For wireless environments connected to the CDE or transmitting account data, all wireless vendor defaults are changed at installation or are confirmed to be secure.2no data
💼 PCI DSS v4.0.1 → 💼 2.3.2 For wireless environments connected to the CDE or transmitting account data, wireless encryption keys that are changed.2no data
💼 PCI DSS v4.0.1 → 💼 7.2.2 Access is assigned to users, including privileged users, based on job classification, function, and least privileges.5no data
💼 PCI DSS v4.0 → 💼 2.2.2 Vendor default accounts are managed.9no data
💼 PCI DSS v4.0 → 💼 2.3.1 For wireless environments connected to the CDE or transmitting account data, all wireless vendor defaults are changed at installation or are confirmed to be secure.2no data
💼 PCI DSS v4.0 → 💼 2.3.2 For wireless environments connected to the CDE or transmitting account data, wireless encryption keys that are changed.2no data
💼 PCI DSS v4.0 → 💼 7.2.2 Access is assigned to users, including privileged users, based on job classification, function, and least privileges.5no data
💼 SOC 2 → 💼 CC6.3-1 Creates or Modifies Access to Protected Information Assets3no data
💼 SOC 2 → 💼 CC6.3-2 Removes Access to Protected Information Assets3no data
💼 SOC 2 → 💼 CC6.3-3 Uses Access Control Structures14no data