VM Instances Should Not Use Default Service Account
More Info:
It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.Risk Level
HighAddress
SecurityCompliance Standards
CISGCP, CBP, HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the misconfiguration “VM Instances Should Not Use Default Service Account” for GCP using GCP console:
- Open the GCP console and navigate to the Compute Engine page.
- Select the VM instance that is using the default service account.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “Cloud API access scopes” section.
- Click on the “Set access for each API” link.
- Uncheck the box next to “Allow default access to all Cloud APIs”.
- Select the specific API access scopes that are required for the VM instance.
- Click on the “Save” button at the bottom of the page.
- Repeat steps 2-8 for all VM instances that are using the default service account.
Using CLI
Using CLI
To remediate the misconfiguration “VM Instances Should Not Use Default Service Account” in GCP using GCP CLI, you can follow the below steps:Step 1: List all the instances that are using the default service account by running the following command:Note: Replace [PROJECT_NUMBER] with your GCP project number.Step 2: For each instance that is using the default service account, create a new service account and assign the required IAM roles to it by running the following commands:Note: Replace [NEW_SERVICE_ACCOUNT_NAME] and [NEW_SERVICE_ACCOUNT_DISPLAY_NAME] with the desired name and display name for the new service account, [PROJECT_ID] with your GCP project ID and [REQUIRED_IAM_ROLE] with the required IAM role for the instance.Step 3: Update the instance to use the new service account by running the following command:Note: Replace [INSTANCE_NAME] with the name of the instance that needs to be updated and [NEW_SERVICE_ACCOUNT_NAME]@[PROJECT_ID].iam.gserviceaccount.com with the name of the new service account created in Step 2.Step 4: Verify that the instance is now using the new service account by running the following command:Note: Replace [INSTANCE_NAME] with the name of the instance that was updated in Step 3.Repeat the above steps for all the instances that are using the default service account to remediate the misconfiguration.
Using Python
Using Python
To remediate the issue “VM Instances Should Not Use Default Service Account” for GCP using Python, you can follow the below steps:In the above code, we are updating the service account for each instance to a new service account
- First, we need to identify the list of all VM instances that are using the default service account. This can be achieved by using the Google Cloud Python SDK’s
googleapiclientlibrary.
- Once we have identified the instances that are using the default service account, we need to update the service account for each instance. This can be done using the
instances().setServiceAccountmethod.
[email protected] with cloud-platform scope. You can replace this with the appropriate service account and scopes as per your requirements.- Finally, you can verify that the instances are no longer using the default service account by running the code in step 1 again.