Control: 4.2 Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account
Compute Engine default service account with Scope
Allow full access to all Cloud APIs.
Along with ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account
Compute Engine default service account for an instances to access necessary cloud services.
Project Editor role is assigned to
Compute Engine default service account hence, This service account has almost all capabilities over all cloud services except billing. However, when Compute Engine default service account assigned to an instance it can operate in 3 scopes.
1. Allow default access: Allows only minimum access required to run an Instance (Least Privileges)2. Allow full access to all Cloud APIs: Allow full access to all the cloud APIs/Services (Too much access)3. Set access for each API: Allows Instance administrator to choose only those APIs that are needed to perform specific business functionalityexpected by instance
When an instance is configured with Compute Engine default service account with Scope Allow full access to all Cloud APIs, based on IAM roles assigned to the user(s) accessing Instance, it may allow user to perform cloud operations/API calls that user is not supposed to perform leading to successful privilege escalation.
- Login to GCP VM Console.
- Click on the instance name to go to its VM instance details page.
- If the instance is not stopped, click the Stop button. Wait for the instance to be stopped.
- In VM instance details page, navigate to section
Service Account, ensure that the default Compute Engine service account is not used.
- Also ensure that, with different service account
Allow full access to all Cloud APIsis not selected.
From Command Line
- List Instances from project
gcloud compute instances list
- Get the details on each instance:
gcloud compute instances describe INSTANCE_NAME --zone ZONE
- Ensure that the instance is not configured to allow the https://www.googleapis.com/auth/cloud-platform scope for the default Compute Engine service account in it's scope
serviceAccounts:- email: [PROJECT_NUMBER]-firstname.lastname@example.org:- https://www.googleapis.com/auth/cloud-platform
Note: Instances created by GKE should be excluded. These instances have names that start with "gke-" and are labeled "goog-gke-node"
steampipe check gcp_compliance.control.cis_v120_4_2
This control uses a named query:compute_instance_with_no_default_service_account_with_full_access