Check ID: iam_sa_no_administrative_privileges
Provider: GCP
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: iam.googleapis.com/ServiceAccount

​
What this check verifies

Google Cloud service accounts with high-privilege IAM roles are identified, including roles/owner, roles/editor, or any role containing admin. The evaluation looks for service accounts bound to these roles in IAM policies across the project hierarchy.

​
Risk

Over-privileged service accounts jeopardize the CIA triad:
  • Confidentiality: data can be read and exfiltrated
  • Integrity: configs, IAM, and code can be altered
  • Availability: resources can be deleted or halted
Compromise via key theft or impersonation enables lateral movement and persistence.

​
Recommendation

Apply least privilege: replace roles/owner, roles/editor, and roles containing admin with narrowly scoped predefined or custom roles. Use separation of duties, temporary elevation, and IAM Conditions to limit scope and time. Prefer impersonation over long-lived keys and monitor SA usage.

​
Remediation

gcloud projects remove-iam-policy-binding <PROJECT_ID> --member=serviceAccount:<SERVICE_ACCOUNT_EMAIL> --role=<ROLE>

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_sa_no_administrative_privileges. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks