Check ID: gke_cluster_no_default_service_account
Provider: GCP
Service: gke
Severity: MEDIUM
Categories: identity-access
Resource type: container.googleapis.com/Cluster

​
What this check verifies

GKE clusters are evaluated for use of the Compute Engine default service account (default) as the node identity. The expectation is that clusters and node pools run with dedicated, minimally privileged IAM service accounts instead of the project-wide default.

​
Risk

Default node service accounts often have broad project access. If a node is compromised, its credentials can read secrets, modify resources, or delete infrastructure, enabling lateral movement and data exfiltration. This harms confidentiality, integrity, and availability across the environment.

​
Recommendation

Assign a custom, least-privileged IAM service account to each node pool instead of default.
  • Grant only permissions required for node logging/monitoring and operations
  • Enforce separation of duties and restrict impersonation
  • Periodically review roles and audit usage for defense in depth

​
Remediation

gcloud container node-pools create <example_resource_name> --cluster=<example_resource_name> --location <example_resource_name> --service-account=<example_resource_name>@<example_resource_id>.iam.gserviceaccount.com

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = gke_cluster_no_default_service_account. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks