Google CloudOverview
To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account Compute Engine default service account with Scope Allow full access to all Cloud APIs.
Rationale
Along with ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account Compute Engine default service account for an instances to access necessary cloud services. Project Editor role is assigned to Compute Engine default service account hence, This service account has almost all capabilities over all cloud services except billing. However, when Compute Engine default service account assigned to an instance it can operate in 3 scopes.
1. Allow default access: Allows only minimum access required to run an Instance (Least Privileges)
2. Allow full access to all Cloud APIs: Allow full access to all the cloud APIs/Services (Too much access)
3. Set access for each API: Allows Instance administrator to choose only those APIs that are needed to perform specific business functionality expected by instance
When an instance is configured with Compute Engine default service account with Scope Allow full access to all Cloud APIs, based on IAM roles assigned to the user(s) accessing Instance, it may allow user to perform cloud operations/API calls that user is not supposed to perform leading to successful privilege escalation.
Remediation guidance
From Console
From Console
- Go to the
VM instancespage by visiting: https://console.cloud.google.com/compute/instances. - Click on the impacted VM instance.
- If the instance is not stopped, click the
Stopbutton. Wait for the instance to be stopped. - Next, click the
Editbutton. - Scroll down to the
Service Accountsection. - Select a different service account or ensure that
Allow full access to all Cloud APIsis not selected. - Click the
Savebutton to save your changes and then clickSTART.
From Command Line
- Stop the instance:
gcloud compute instances stop
- Update the instance:
gcloud compute instances set-service-account --service- account= --scopes [SCOPE1, SCOPE2...]
- Restart the instance:
gcloud compute instances start
Default Value
While creating a VM instance, default service account is used with scope Allow default access.
**Impact**
In order to change service account or scope for an instance, it needs to be stopped.
**References**
1. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances
2. https://cloud.google.com/compute/docs/access/service-accounts
**Notes**
- User IAM roles will override service account scope but configuring minimal scope ensures defense in depth
- Non-default service accounts do not offer selection of access scopes like default service account. IAM roles with non-default service accounts should be used to control VM access.
## Multiple Remediation Paths
### Google Cloud
**SERVICE-WIDE (RECOMMENDED when many resources are affected):**
Enforce Organization Policies at org/folder level so new resources inherit secure defaults.
~~~bash
gcloud org-policies set-policy policy.yaml
~~~
**ASSET-LEVEL:**
Use the product-specific remediation steps above for only the impacted project/resources.
**PREVENTIVE:**
Use org policy constraints/custom constraints and enforce checks in deployment pipelines.
### References for Service-Wide Patterns
- GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
- GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies
## Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
### 1. Contain at Service-Wide Scope First (Recommended)
- Google Cloud: apply organization policy constraints at org/folder scope.
~~~bash
gcloud org-policies set-policy policy.yaml
~~~
### 2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
### 3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
Instances are not configured to use the default service account with full access to all Cloud APIs
Connectors
Covered asset types
Expected check: eq []
GCPVM1{...AssetFragment}
