Ensure that the creation of Cloud IAM service accounts is prevented within your Google Cloud organization through the "Disable Service Account Creation" organization policy. This allows you to easily centralize the management of your service accounts while not restricting the other permissions that your developers and administrators have on the projects within the organization. A Cloud IAM service account is a special account that can be used by services and applications running on your Compute Engine instances to interact with other Google Cloud APIs. Applications can use service account credentials to authorize themselves to a set of APIs and perform actions within the permissions granted to the service account.
By default, the Cloud IAM service accounts can be created by users based on their IAM roles and permissions. Through Google Cloud organization policies, you have centralized and programmatic control over your organization's cloud resources. As a Google Cloud organization administrator, you will be able to configure restrictions across your entire resource hierarchy. To define and establish constraints for your development teams in order to stay within the compliance boundaries set for your organization, you may want to use the "iam.disableServiceAccountCreation" boolean constraint to disable the creation of new service accounts. Preventing the creation of Cloud IAM service accounts for certain projects within your organization can will significantly reduce the chances that a compromised service account can be used without your knowledge to access certain Google Cloud components and resources.
Audit
To determine if the creation of service accounts is disabled within your Google Cloud organizations, perform the following operations:
Remediation / Resolution
To ensure that Cloud IAM service account creation is disabled at your Google Cloud organization level, enable the "Disable Service Account Creation" organization policy, by performing the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Service accounts
- Introduction to the Organization Policy Service
- Restricting service account usage
- GCP Command Line Interface (CLI) Documentation
- gcloud organizations list
- gcloud alpha resource-manager org-policies describe
- gcloud alpha resource-manager org-policies enable-enforce
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
![Confirmity Cloud Platform](/cloudoneconformity/assets/v2/images/common/conformity-platform-cloud.png)
You are auditing:
Prevent Service Account Creation for Google Cloud Organizations
Risk Level: Medium