> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-gcp-1.md).

# GCP Kubernetes Engine Cluster Nodes have default Service account for Project access misconfiguration

## Rule Details

|                        |                                      |
| ---------------------- | ------------------------------------ |
| Cortex AppSec Rule ID  | APPSEC2\_GCP\_1                      |
| Category - Subcategory | Kubernetes - Access Control          |
| Provider               | GCP                                  |
| Severity               | LOW                                  |
| Framework              | Terraform, Terraform Plan            |
| Mapped CSPM/KSPM Rule  | cc010769-cdf3-46f0-8c76-d5c7ae355015 |

## Impact

Create and use minimally privileged Service accounts to run GKE cluster nodes instead of using the Compute Engine default Service account. Unnecessary permissions could be abused in the case of a node compromise. A GCP service account (as distinct from a Kubernetes ServiceAccount) is an identity that an instance or an application can use to run GCP API requests on your behalf. This identity is used to identify virtual machine instances to other Google Cloud Platform services. By default, Kubernetes Engine nodes use the Compute Engine default service account. This account has broad access by default, as defined by access scopes, making it useful to a wide variety of applications on the VM, but it has more permissions than are required to run your Kubernetes Engine cluster. You should create and use a minimally privileged service account to run your Kubernetes Engine cluster instead of using the Compute Engine default service account, and create separate service accounts for each Kubernetes Workload (See Recommendation 6.2.2). Kubernetes Engine requires, at a minimum, the node service account to have the monitoring.viewer, monitoring.metricWriter, and logging.logWriter roles. Additional roles may need to be added for the nodes to pull images from GCR.

## How to Fix

*Resource:* google\_container\_node\_pool / google\_container\_cluster

* *Arguments:* google\_project\_default\_service\_accounts \[source,go]

***

{ "resource "google\_project\_default\_service\_accounts" "not\_ok" { project = "my-project-id" action = "DELETE" id="1234" }

resource "google\_container\_node\_pool" "primary\_A\_not\_ok" { name = "my-node-pool" ...

* service\_account = google\_project\_default\_service\_accounts.not\_ok.id oauth\_scopes = \[ "<https://www.googleapis.com/auth/cloud-platform>" ] }

}

resource "google\_container\_cluster" "primary\_B\_not\_ok" {

... node\_config {

* service\_account = google\_project\_default\_service\_accounts.not\_ok.id oauth\_scopes = \[ "<https://www.googleapis.com/auth/cloud-platform>" ] }

}

## ", }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-gcp-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.