GCP VM instance configured with default service account misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_30
Category - Subcategory	IAM - Overly Permissive
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	6f326cc0-c19e-4d9d-9cbc-e226dd6b58eb

Impact

The default Compute Engine service account has Editor role on the project, allowing read and write access to most Google Cloud Services. We recommend you configure your instance to not use the default Compute Engine service account. You should create a new service account and assign only the permissions needed by your instance. This helps defend against compromised VM privilege escalations and prevent an attacker from gaining access to all of your project.

NOTE: The default Compute Engine service account is named: [PROJECT_NUMBER][e-mail].

How to Fix

Resource: google_compute_instance

• Field: service_account
• Arguments: email = <email other than the default service_account's> [source,go]

---

resource "google_compute_instance" "default" { name = "test" machine_type = "n1-standard-1" zone = "us-central1-a"

• service_account { scopes = ["userinfo-email", "compute-ro", "storage-ro"]
• email = "[PROJECT_NUMBER][e-mail]"
• email = "[e-mail]" } }

---