Check ID: iam_role_sa_enforce_separation_of_duties
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: cloudresourcemanager.googleapis.com/Project

​
What this check verifies

Google Cloud IAM policies are evaluated to find principals granted both roles/iam.serviceAccountAdmin and roles/iam.serviceAccountUser within a project. Service-account related roles are expected to be segregated so that service account lifecycle management is distinct from their use or impersonation.

​
Risk

With both roles, a principal can create or modify service accounts and then use or attach them to workloads, enabling unchecked impersonation. This endangers confidentiality (expanded data access), integrity (policy/workload changes), and availability (persistence or sabotage via privileged automation).

​
Recommendation

Enforce separation of duties: assign roles/iam.serviceAccountAdmin for lifecycle tasks and roles/iam.serviceAccountUser for attach/impersonate, never both to one principal.
  • Apply least privilege with narrow scope and conditions
  • Use temporary elevation/approvals
  • Regularly audit IAM bindings and logs

​
Remediation

# Remove all project-level principals from Service Account User
resource "google_project_iam_binding" "sa_user_none" {
  project = "<example_resource_id>"
  role    = "roles/iam.serviceAccountUser"  # critical: target role to clear at project level
  members = []                                # critical: empty list removes the binding (no members)
}

# Remove all project-level principals from Service Account Admin
resource "google_project_iam_binding" "sa_admin_none" {
  project = "<example_resource_id>"
  role    = "roles/iam.serviceAccountAdmin"  # critical: target role to clear at project level
  members = []                                 # critical: empty list removes the binding (no members)
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_role_sa_enforce_separation_of_duties. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks