User Managed Service Account Should Not Have Admin Priviledges
More Info:
Ensure that user managed service accounts do not have any admin, owner, or write privileges. Service accounts are primarily used for API access to Google. It is recommended to not use admin access for service accounts.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP, CBP, HIPAA, ISO27001, HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “User Managed Service Account Should Not Have Admin Privileges” in GCP using GCP console, follow the below steps:
- Login to the Google Cloud Console with your credentials.
- Navigate to the “IAM & Admin” section of the console.
- Select “Service Accounts” from the left-hand menu.
- Locate the user-managed service account that has admin privileges.
- Click on the service account to open its details page.
- Click on the “Permissions” tab.
- Scroll down to the “Role” section and click the “Edit” button.
- Remove the admin role from the service account by unchecking the box next to the role.
- Click “Save” to save the changes.
- Verify that the service account no longer has admin privileges by checking the “Permissions” tab.
Using CLI
Using CLI
To remediate the misconfiguration “User Managed Service Account Should Not Have Admin Privileges” in GCP using GCP CLI, follow the below steps:Replace Replace
- Identify the user-managed service account that has admin privileges using the following command:
- Once you have identified the service account, remove the admin role from the service account using the following command:
[PROJECT_ID] with your project ID and [SERVICE_ACCOUNT_EMAIL] with the email address of the service account.- Verify that the admin role has been removed from the service account using the following command:
[PROJECT_ID] with your project ID and [SERVICE_ACCOUNT_EMAIL] with the email address of the service account.This should remediate the misconfiguration “User Managed Service Account Should Not Have Admin Privileges” in GCP using GCP CLI.Using Python
Using Python
To remediate the misconfiguration “User Managed Service Account Should Not Have Admin Privileges” in GCP using Python, you can follow the below steps:Replace Replace
- First, you need to identify all the user-managed service accounts that have admin privileges. You can use the following code to do this:
path/to/service_account_key.json with the path to your service account key file and PROJECT_ID with your GCP project ID.- Once you have identified the user-managed service accounts with admin privileges, you can remove the admin role from them using the following code:
PROJECT_ID with your GCP project ID and set the user_managed_service_account variable to the email address of the user-managed service account that you want to remove the admin role from.These steps will remediate the misconfiguration “User Managed Service Account Should Not Have Admin Privileges” in GCP using Python.