> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-31.md).

# GCP VM instance using a default service account with Cloud Platform access scope misconfiguration de

## Rule Details

|                        |                                      |
| ---------------------- | ------------------------------------ |
| Cortex AppSec Rule ID  | APPSEC\_GCP\_31                      |
| Category - Subcategory | IAM - Overly Permissive              |
| Provider               | GCP                                  |
| Severity               | MEDIUM                               |
| Framework              | Terraform, Terraform Plan            |
| Mapped CSPM/KSPM Rule  | b47d9e56-f289-46c4-a8e2-3c0b564f2c6a |

## Impact

When an instance is configured with *Compute Engine default service account* with Scope *Allow full access to all Cloud APIs*, based on IAM roles assigned to the user(s) accessing Instance, it may result in privilege escalation. For example, a user may have permission to perform cloud operations and API calls that they are not required to perform. Along with the ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account *Compute Engine default service account* for an instances to access necessary cloud services. *Project Editor* role is assigned to *Compute Engine default service account* for this service account to have almost all capabilities over all cloud services, except billing. When *Compute Engine default service account* is assigned to an instance it can operate in three scopes:

. *Allow default access*: Allows only minimum access required to run an Instance (Least Privileges).

. *Allow full access to all Cloud APIs*: Allows full access to all the cloud APIs/Services (too much access).

. *Set access for each API*: Allows Instance administrator to choose only those APIs that are needed to perform specific business functionality expected by instance. + We recommend you do not assign instances to default service account *Compute Engine default service account* with Scope *Allow full access to all Cloud APIs*. + This supports the principle of least privileges and helps prevent potential privilege escalation,

## How to Fix

*Resource:* google\_compute\_instance

* *Field:* service\_account
* *Arguments:* If\*\* email\*\* is set to the default service account, or not specified, *scope* should not contain full access api. \[source,go]

***

resource "google\_compute\_instance" "default" { name = "test" machine\_type = "n1-standard-1" zone = "us-central1-a" service\_account {

* scopes = \["<https://www.googleapis.com/auth/cloud-platform>"]
* email = "\[PROJECT\_NUMBER]<-compute@developer.gserviceaccount.com>"" } }

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-31.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.