Project has Access Approval enabled

Check ID: iam_account_access_approval_enabled
Provider: GCP
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: accessapproval.googleapis.com/AccessApprovalSettings

What this check verifies

GCP project has Access Approval configured at the project level, requiring explicit customer authorization before Google personnel can access project data. The evaluation looks for Access Approval settings associated with the project.

Risk

Without Access Approval, Google support or engineering may access Customer Data without prior consent, weakening confidentiality and accountability. Reduced visibility hinders incident response and raises exposure for sensitive or regulated workloads.

Recommendation

Enable Access Approval for projects and where feasible at higher hierarchy for consistency. Assign least-privilege approvers with separation of duties, integrate timely notifications, and monitor Access Transparency records to maintain defense in depth.

Remediation

CLI
Terraform
Dashboard steps

gcloud access-approval settings update --project=<PROJECT_ID> --enrolled-services=all

resource "google_access_approval_settings" "<example_resource_name>" {
  project = "<example_resource_id>"

  enrolled_services {
    cloud_product    = "all"       # Critical: enroll all services to enable Access Approval for the project
    enrollment_level = "BLOCK_ALL" # Critical: require approval for all applicable access requests
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_account_access_approval_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

GKE cluster does not use the default service account GCP project has Cloud Audit Logs enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires