Check ID: iam_no_service_roles_at_project_level
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: cloudresourcemanager.googleapis.com/Project

​
What this check verifies

Google Cloud IAM policies are inspected for project-level grants of roles/iam.serviceAccountUser and roles/iam.serviceAccountTokenCreator to principals. The focus is on bindings that enable attaching or impersonating service accounts at the project scope rather than on individual service accounts.

​
Risk

Project-wide impersonation rights enable privilege escalation and lateral movement. Holders can act as any service account, access data across services, modify resources, and persist access. New service accounts inherit exposure, undermining confidentiality and integrity.

​
Recommendation

Assign roles/iam.serviceAccountUser and roles/iam.serviceAccountTokenCreator only on the specific service account, not at project scope. Enforce least privilege and separation of duties with per-SA grants, conditional bindings, and time-bound access. Prefer short-lived impersonation; review grants regularly.

​
Remediation

# Grant required access at the service account level instead of the project level
resource "google_service_account_iam_member" "<example_resource_name>" {
  service_account_id = "projects/<example_resource_id>/serviceAccounts/<example_resource_name>@<example_resource_id>.iam.gserviceaccount.com"  # CRITICAL: scope grant to a specific service account, not the project
  role               = "roles/iam.serviceAccountUser"  # CRITICAL: this role is granted only at the service account level
  member             = "user:<example_resource_name>@example.com"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_no_service_roles_at_project_level. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks