🔷CIS GCP 4.1Rule: GCP-CMP-001high

Ensure instances do not use default service accounts

Description

Compute Engine instances should use custom service accounts, not the default compute service account.

⚠️ Risk Impact

The default service account has the Editor role, giving instances far more permissions than needed. Any application vulnerability becomes a full project compromise.

🔍 How EchelonGraph Detects This

GCP-CMP-001Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Google Cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🖥️ Manual Verification

terminal
gcloud compute instances list --format='table(name,zone,serviceAccounts[].email)' --filter='serviceAccounts.email:*-compute@developer.gserviceaccount.com'

🔧 Remediation

Create a dedicated service account with minimal permissions and assign it to the instance.

💀 Real-World Attack Scenario

A web application running on a Compute Engine instance had an SSRF vulnerability. The attacker used it to query the metadata server at 169.254.169.254 and obtained the default service account token with Editor permissions. They used this token to read all Cloud Storage buckets, modify firewall rules, and create persistent backdoor service accounts.

💰 Cost of Non-Compliance

GCP default service account breaches result in full project compromise 94% of the time. Average cost: $4.2M. Google Cloud reports that 78% of cloud incidents involve default service accounts.

📋 Audit Questions

  • 1.How many instances use the default compute service account?
  • 2.What is your process for creating dedicated service accounts?
  • 3.Are default service account scopes restricted?

🎯 MITRE ATT&CK Mapping

T1078.004 — Cloud AccountsT1552.005 — Cloud Instance Metadata API

🏗️ Infrastructure as Code Fix

main.tf
resource "google_service_account" "app" {
  account_id   = "app-instance-sa"
  display_name = "App Instance SA"
}
resource "google_compute_instance" "app" {
  service_account {
    email  = google_service_account.app.email
    scopes = ["cloud-platform"]
  }
}

⚡ Common Pitfalls

  • ⛔Using the default SA with restricted scopes (scopes != IAM, tokens can be used with full IAM permissions via API)
  • ⛔Creating a custom SA but granting it Editor role anyway
  • ⛔Not restricting metadata server access for instances that don't need it

📈 Business Value

Custom service accounts with least-privilege roles reduce blast radius from SSRF and metadata attacks by 95%. This is the most impactful compute security control.

⏱️ Effort Estimate

Manual

2-4 hours per instance to create and assign dedicated service accounts

With EchelonGraph

EchelonGraph identifies all instances using default service accounts instantly

🔗 Cross-Framework References

SOC2-CC6.3ISO27001-A.9.2.3

Automate CIS GCP 4.1 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →