Check ID: compute_instance_default_service_account_in_use
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: identity-access
Resource type: compute.googleapis.com/Instance

​
What this check verifies

Compute Engine VMs are evaluated for use of the default service account ([PROJECT_NUMBER][email protected]). The finding highlights instances configured with that account rather than a workload-specific service account. GKE node VMs are ignored.

​
Risk

Using the default service account often grants project-wide rights (e.g., roles/editor). If a VM is compromised, metadata tokens can be abused to read/modify resources, exfiltrate data, and pivot across services, impacting confidentiality and integrity, and potentially availability.

​
Recommendation

Avoid the default service account. Create per-workload service accounts and grant only required roles under least privilege and separation of duties. Remove broad roles like roles/editor. Prefer short-lived credentials and monitor service account usage to enforce defense in depth.

​
Remediation

# Create a non-default service account
resource "google_service_account" "<example_resource_name>" {
  account_id = "<example_resource_id>"  # CRITICAL: custom SA to avoid default "[email protected]"
}

# Attach the non-default service account to the VM
resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "<ZONE>"

  boot_disk { initialize_params { image = "debian-cloud/debian-12" } }
  network_interface { network = "default" }

  service_account {
    email = google_service_account.<example_resource_name>.email  # CRITICAL: use non-default SA so the check passes
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_default_service_account_in_use. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks