> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# K8s default service account remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Default Service Accounts Should Not Be Used" in GCP using GCP console, please follow these steps:

        1. Open the GCP Console and navigate to the "IAM & Admin" section.

        2. Click on "Service Accounts" in the left-hand menu.

        3. Identify the default service accounts that are being used in your project. The default service accounts are "App Engine default service account" and "Compute Engine default service account".

        4. Click on the default service account you want to remediate.

        5. Click on the "Edit" button at the top of the page.

        6. Scroll down to the "Roles" section and remove any unnecessary roles that have been assigned to the default service account.

        7. Click on "Save" to apply the changes.

        8. Repeat steps 4-7 for all default service accounts being used in your project.

        9. Create new service accounts with the appropriate roles and permissions for your project.

        10. Update your applications and services to use the new service accounts instead of the default service accounts.

        By following these steps, you will have successfully remediated the misconfiguration "Default Service Accounts Should Not Be Used" in GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Default Service Accounts Should Not Be Used" misconfiguration for GCP using GCP CLI, follow these steps:

        1. Open the GCP Cloud Shell.

        2. Run the following command to list all the default service accounts in your GCP project:

           ```
           gcloud iam service-accounts list
           ```

        3. Identify the default service account that you want to disable.

        4. Run the following command to disable the default service account:

           ```
           gcloud iam service-accounts disable [SERVICE_ACCOUNT_EMAIL]
           ```

           Replace `[SERVICE_ACCOUNT_EMAIL]` with the email address of the default service account that you want to disable.

        5. Verify that the default service account has been disabled by running the following command:

           ```
           gcloud iam service-accounts describe [SERVICE_ACCOUNT_EMAIL]
           ```

           Replace `[SERVICE_ACCOUNT_EMAIL]` with the email address of the default service account that you disabled. The output should show that the account is disabled.

        6. Repeat steps 4-5 for any other default service accounts that you want to disable.

        By following these steps, you have successfully remediated the "Default Service Accounts Should Not Be Used" misconfiguration for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Default Service Accounts Should Not Be Used" in GCP using Python, you can follow these steps:

        1. Identify the default service accounts that are currently being used in your GCP project. You can do this by running the following command in the Cloud Shell or in your local terminal with gcloud CLI installed:

        ```
        gcloud iam service-accounts list
        ```

        2. Create a new service account to replace the default service account. You can do this by running the following command:

        ```
        gcloud iam service-accounts create [SA-NAME] --description="[SA-DESCRIPTION]"
        ```

        Replace \[SA-NAME] and \[SA-DESCRIPTION] with your desired service account name and description.

        3. Grant the necessary roles and permissions to the new service account. You can do this by running the following command:

        ```
        gcloud projects add-iam-policy-binding [PROJECT-ID] --member="serviceAccount:[SA-EMAIL]" --role="[ROLE]"
        ```

        Replace \[PROJECT-ID], \[SA-EMAIL], and \[ROLE] with your project ID, new service account email, and the desired role to grant to the service account.

        4. Update your application or service to use the new service account instead of the default service account. You can do this by setting the GOOGLE\_APPLICATION\_CREDENTIALS environment variable to the path of the new service account key file.

        ```
        export GOOGLE_APPLICATION_CREDENTIALS="[PATH]"
        ```

        Replace \[PATH] with the path to the new service account key file.

        5. Disable the default service account to prevent it from being used. You can do this by running the following command:

        ```
        gcloud iam service-accounts disable [SA-EMAIL]
        ```

        Replace \[SA-EMAIL] with the email of the default service account.

        By following these steps, you can remediate the misconfiguration "Default Service Accounts Should Not Be Used" in GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Create a dedicated service account for GKE nodes
        resource "google_service_account" "gke_nodes" {
          account_id   = "GKE_NODES_SA_ID"        # e.g. "gke-nodes"
          display_name = "GKE Nodes Service Account"
        }

        # Grant only the minimal roles your nodes actually need
        # (replace with least-privilege roles for your workloads)
        resource "google_project_iam_member" "gke_nodes_logging" {
          project = "GCP_PROJECT_ID"              # replace with your GCP project ID
          role    = "roles/logging.logWriter"
          member  = "serviceAccount:${google_service_account.gke_nodes.email}"
        }

        resource "google_project_iam_member" "gke_nodes_monitoring" {
          project = "GCP_PROJECT_ID"
          role    = "roles/monitoring.metricWriter"
          member  = "serviceAccount:${google_service_account.gke_nodes.email}"
        }

        # Attach the custom service account to the default node pool
        # (if you use separate google_container_node_pool resources, set node_config there instead)
        resource "google_container_cluster" "primary" {
          name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
          project  = "GCP_PROJECT_ID"
          location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1" or "us-central1-a"

          remove_default_node_pool = false       # or true if you manage pools separately

          node_config {
            # This must NOT be the project’s default compute service account
            service_account = google_service_account.gke_nodes.email

            # other existing fields...
            machine_type = "e2-medium"
            oauth_scopes = [
              "https://www.googleapis.com/auth/cloud-platform",
            ]
          }

          # other existing cluster arguments...
        }
        ```

        Changing the `node_config.service_account` on an existing node pool forces the node pool (and its nodes) to be recreated, which can cause disruption if not done with surge/rolling settings and enough capacity.

        To verify, `terraform plan` should show that the only relevant functional change on the cluster/node pool is updating `node_config.service_account` from the default service account to `google_service_account.gke_nodes.email` (plus creation of the new service account and IAM bindings).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>