Control: Ensure that instances are not configured to use the default service account with full access to all Cloud APIs

Description

To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account Compute Engine default service account with Scope Allow full access to all Cloud APIs.

Usage

Run the control in your terminal:

powerpipe control run terraform_gcp_compliance.control.compute_instance_with_no_default_service_account_with_full_access

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_gcp_compliance.control.compute_instance_with_no_default_service_account_with_full_access --share

SQL

This control uses a named query:

compute_instance_with_no_default_service_account_with_full_access

Control: Ensure that instances are not configured to use the default service account with full access to all Cloud APIs

Description

Usage

SQL

Tags