Check ID: compute_instance_default_service_account_in_use_with_full_api_access
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: identity-access
Resource type: compute.googleapis.com/Instance

​
What this check verifies

Compute Engine VM instances using the default service account with the cloud-platform scope (Allow full access to all Cloud APIs) are identified. GKE nodes are excluded.

​
Risk

With full API scope, any code on the VM can obtain tokens and, combined with the service account’s roles, call broad Google Cloud APIs. This enables privilege escalation, data exfiltration, unauthorized config changes, and service disruption, impacting confidentiality, integrity, and availability.

​
Recommendation

Use a custom, least-privileged service account per VM and avoid the default account. Restrict Cloud API scopes-prefer minimal or per-API scopes, not Allow full access to all Cloud APIs. Enforce least privilege and separation of duties, and regularly review roles to remove excessive permissions.

​
Remediation

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "us-central1-a"

  boot_disk { initialize_params { image = "debian-cloud/debian-12" } }
  network_interface { network = "default" }

  service_account {
    email  = "<example_service_account_email>" # FIX: use a non-default service account to avoid the default SA
    scopes = ["https://www.googleapis.com/auth/devstorage.read_only"] # FIX: avoid cloud-platform (full API access)
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_default_service_account_in_use_with_full_api_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks