> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Service account separation remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Service Accounts Admin And User Permissions Should Not Be Assigned At The Same Time" for GCP using GCP console, follow the below steps: 1. Login to the GCP console ([https://console.cloud.google.com/](https://console.cloud.google.com/)). 2. Navigate to the IAM & Admin page by clicking on the hamburger menu on the top left corner and selecting "IAM & Admin" from the menu. 3. Select "Service accounts" from the left-hand menu. 4. Locate the service account that has both admin and user permissions assigned to it. 5. Click on the service account to view its details. 6. Click on the "Permissions" tab to view the permissions assigned to the service account. 7. Remove the admin permissions from the service account by clicking on the "Edit" button next to the role that has admin permissions assigned to it. 8. Deselect the admin role and click "Save" to remove the admin permissions. 9. Verify that the service account now only has user permissions assigned to it. By following these steps, the misconfiguration "Service Accounts Admin And User Permissions Should Not Be Assigned At The Same Time" will be remediated for GCP. # To remediate the misconfiguration of assigning both Service Accounts Admin and User permissions at the same time in GCP using GCP CLI, follow these steps: 1. Open the Google Cloud Shell from the GCP console. 2. Run the following command to list all the IAM policies of the project: ``` gcloud projects get-iam-policy ``` Replace `` with the actual project ID. 3. Identify the service account that has both Service Accounts Admin and User permissions assigned to it. 4. Run the following command to remove the Service Accounts Admin role from the service account: ``` gcloud projects remove-iam-policy-binding --member=serviceAccount: --role=roles/iam.serviceAccountAdmin ``` Replace `` with the actual project ID and `` with the email address of the service account. 5. Verify that the Service Accounts Admin role has been removed from the service account by running the following command: ``` gcloud projects get-iam-policy --flatten="bindings[].members" --format="table(bindings.role, bindings.members)" --filter="bindings.members:" ``` Replace `` with the actual project ID and `` with the email address of the service account. 6. If the User role is still assigned to the service account, run the following command to remove it: ``` gcloud projects remove-iam-policy-binding --member=serviceAccount: --role=roles/iam.serviceAccountUser ``` Replace `` with the actual project ID and `` with the email address of the service account. 7. Verify that the User role has been removed from the service account by running the following command: ``` gcloud projects get-iam-policy --flatten="bindings[].members" --format="table(bindings.role, bindings.members)" --filter="bindings.members:" ``` Replace `` with the actual project ID and `` with the email address of the service account. 8. Repeat steps 3-7 for any other service accounts that have both Service Accounts Admin and User permissions assigned to them. By following these steps, you will successfully remediate the misconfiguration of assigning both Service Accounts Admin and User permissions at the same time for GCP using GCP CLI. To remediate the misconfiguration "Service Accounts Admin And User Permissions Should Not Be Assigned At The Same Time" in GCP using Python, follow these steps: 1. Create a list of all the service accounts in your GCP project using the following code: ```python theme={null} from google.oauth2 import service_account from googleapiclient.discovery import build credentials = service_account.Credentials.from_service_account_file( 'path/to/your/credentials.json' ) service = build('iam', 'v1', credentials=credentials) response = service.projects().serviceAccounts().list(name='projects/your-project-id').execute() service_account_emails = [account['email'] for account in response['accounts']] ``` 2. For each service account in the list, check if it has both admin and user permissions assigned to it using the following code: ```python theme={null} for email in service_account_emails: response = service.projects().serviceAccounts().get(name=f'projects/your-project-id/serviceAccounts/{email}').execute() for role in response['iam_roles']: if 'admin' in role.lower() and 'user' in role.lower(): print(f'Service account {email} has both admin and user permissions assigned to it.') ``` 3. If any service account has both admin and user permissions assigned to it, remove the user permissions using the following code: ```python theme={null} for email in service_account_emails: response = service.projects().serviceAccounts().get(name=f'projects/your-project-id/serviceAccounts/{email}').execute() roles_to_remove = [] for role in response['iam_roles']: if 'admin' in role.lower() and 'user' in role.lower(): roles_to_remove.append(role) if roles_to_remove: body = { 'updateMask': 'iam_roles', 'iam_roles': [role for role in response['iam_roles'] if role not in roles_to_remove] } service.projects().serviceAccounts().patch(name=f'projects/your-project-id/serviceAccounts/{email}', body=body).execute() print(f'Removed user permissions from service account {email}.') ``` Note: Replace "your-project-id" with the ID of your GCP project and "path/to/your/credentials.json" with the path to your GCP service account credentials file. Also, make sure that the credentials have the necessary permissions to manage service accounts in your GCP project. ```hcl theme={null} # Example: ensure a principal only has "user" role on a service account, # and NOT the "admin" role at the same time. # Existing service account resource "google_service_account" "example" { account_id = "SERVICE_ACCOUNT_ID" # e.g. "my-app-sa" display_name = "SERVICE_ACCOUNT_NAME" # e.g. "My App Service Account" } # REMOVE any bindings/members that grant roles/iam.serviceAccountAdmin # to this same principal. Do NOT recreate them elsewhere. # BAD (to be removed from your Terraform): # resource "google_service_account_iam_member" "sa_admin_binding" { # service_account_id = google_service_account.example.name # role = "roles/iam.serviceAccountAdmin" # member = "USER_OR_GROUP_IDENTIFIER" # e.g. "user:alice@example.com" # } # GOOD: keep or add only the "user" permission resource "google_service_account_iam_member" "sa_user_binding" { service_account_id = google_service_account.example.name role = "roles/iam.serviceAccountUser" member = "USER_OR_GROUP_IDENTIFIER" # substitute with "user:...", "group:...", or "serviceAccount:..." } ``` If you are assigning these roles at the project (or folder/org) level instead of directly on the service account, ensure that any `google_project_iam_*`, `google_folder_iam_*`, or `google_organization_iam_*` resources that currently give `roles/iam.serviceAccountAdmin` to the same principal are removed, leaving at most `roles/iam.serviceAccountUser`. This change does not force replacement of the service account itself; it only updates IAM bindings. After editing, `terraform plan` should show that all `roles/iam.serviceAccountAdmin` bindings for affected principals are being destroyed and that only the intended `roles/iam.serviceAccountUser` (or other non-admin roles) remain.