🛡️ Google Super Admin Account is used for Google Cloud administration🟢⚪

• Contextual name: 🛡️ Super Admin Account is used for Google Cloud administration🟢⚪
• ID: /ce/ca/google/iam/super-admin-not-used-for-gcp-administration
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

Super Admin accounts should be used only for Google Workspace or Cloud Identity identity administration. Google Cloud administration should be performed with separate user accounts that have appropriate Google Cloud IAM roles.

Rationale

The Super Admin role can manage users, groups, domains, and many identity settings. Combining that role with Google Cloud IAM permissions expands the blast radius of a compromised account. Separating identity administration from cloud resource administration enforces least privilege and provides clearer operational accountability.

Impact

Organizations may need to create separate Google Cloud administrator accounts and remove IAM bindings from existing Super Admin users. Validate that administrators retain the required access through non-Super Admin accounts before removing existing IAM roles.

Audit

From Google Admin Console and Google Cloud Console

1. In the Google Admin Console, go to Account > Admin roles.
2. Open the Super Admin role and note all assigned user accounts.

... see more

Remediation

Open File

Remediation

From Google Admin Console and Google Cloud Console

1. Create separate regular user accounts for Google Cloud administration.
2. Grant those accounts only the Google Cloud IAM roles required for their responsibilities.
3. Review IAM bindings at the organization, folder, and project levels.
4. Remove Super Admin accounts from Google Cloud IAM bindings.
5. Confirm that Super Admin accounts remain reserved for Google Workspace or Cloud Identity administration.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS GCP v5.0.0 → 💼 1.1.2 Ensure Super Admin Account Is Not Used For Google Cloud Administration - Level 1 (Manual)			1		no data
💼 Cloudaware Framework → 💼 General Access Controls			23		no data