> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-41.md).

# GCP IAM user are assigned Service Account User or Service Account Token creator roles at project lev

## Rule Details

|                        |                           |
| ---------------------- | ------------------------- |
| Cortex AppSec Rule ID  | APPSEC\_GCP\_41           |
| Category - Subcategory | IAM - Overly Permissive   |
| Provider               | GCP                       |
| Severity               | HIGH                      |
| Framework              | Terraform, Terraform Plan |

## Impact

A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. Application/VM-Instance uses the service account to call the service's Google API so that end-users are not directly involved. The service account resource has IAM policies attached to it to determine who can use the service account. Users with IAM roles to update the *App Engine* and *Compute Engine* instances, such as *App Engine Deployer* and *Compute Instance Admin*, can run code as the service accounts used to run these instances.

This enables users to indirectly gain access to resources for which the service accounts have access. Similarly, SSH access to a *Compute Engine* instance may also provide the ability to execute code as that instance/Service account. Your organization may have multiple user-managed service accounts configured for a project. Granting the\*\* iam.serviceAccountUser \*or \**iam.serviceAserviceAccountTokenCreatorccountUser* roles to a user for a project gives the user access to all service accounts in the project, including service accounts created in the future.

This can result in elevation of privileges by using service accounts and corresponding *Compute Engine* instances. To implement least privileges best practices, IAM users should not be assigned the *Service Account User* or *Service Account Token Creator* roles at the project level. These roles should be assigned to a user for a specific service account, giving that user access to the service account.

The *Service Account User* allows a user to bind a service account to a long-running job service. The *Service Account Token Creator* role allows a user to directly impersonate, or assert, the identity of a service account. We recommend you assign the Service Account User (iam.serviceAccountUser) and Service Account Token Creator *iam.serviceAccountTokenCreator* roles to a user for a specific service account rather than assigning the role to a user at project level.

## How to Fix

*Resource:* google\_project\_iam\_binding google\_project\_iam\_member

* *Arguments:* role \[source,go]

***

resource "google\_project\_iam\_binding" "project" { project = "your-project-id"

* role = "roles/iam.serviceAccountTokenCreator"
* role = "roles/iam.serviceAccountUser" }

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-41.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.