# Cis GCP Foundations 1.5 > Ensure That Service Account Has No Admin Privileges - Skill: `cyberstrikeus/cis-gcp-foundations-1-5` (Agent Skill) - Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-gcp-foundations-1-5` - Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-gcp-foundations-1-5/raw - Safety review: PASS (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/cyberstrikeus/cis-gcp-foundations-1-5 --- # 1.5 Ensure That Service Account Has No Admin Privileges (Automated) ## Profile Applicability - Level 1 ## Description A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. The application uses the service account to call the service's Google API so that users aren't directly involved. It's recommended not to use admin access for ServiceAccount. ## Rationale Service accounts represent service-level security of the Resources (application or a VM) which can be determined by the roles assigned to it. Enrolling ServiceAccount with Admin rights gives full access to an assigned application or a VM. A ServiceAccount Access holder can perform critical actions like delete, update change settings, etc. without user intervention. For this reason, it's recommended that service accounts not have Admin rights. ## Impact Removing `*Admin` or `*admin` or `Editor` or `Owner` role assignments from service accounts may break functionality that uses impacted service accounts. Required role(s) should be assigned to impacted service accounts in order to restore broken functionalities. ## Audit Procedure **From Google Cloud Console** 1. Go to `IAM & admin/IAM` using `https://console.cloud.google.com/iam-admin/iam` 2. Under the `IAM` Tab look for `VIEW BY PRINCIPALS` 3. Filter `PRINCIPALS` using `type : Service account` 4. Look for the Service Account with the nomenclature: `SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com` 5. Ensure that there are no such Service Accounts with roles containing `*Admin` or `*admin` or role matching `Editor` or role matching `Owner` under `Role` column. **From Google Cloud CLI** 1. Get the policy that you want to modify, and write it to a JSON file: ```bash gcloud projects get-iam-policy PROJECT_ID --format json > iam.json ``` 2. The contents of the JSON file will look similar to the following. Note that `role` of members group associated with each `serviceaccount` does not contain `*Admin` or `*admin` or does not match `roles/editor` or does not match `roles/owner`. This recommendation is only applicable to `User-Managed user-created` service accounts. These accounts have the nomenclature: `SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com`. Note that some Google-managed, Google-created service accounts have the same naming format, and should be excluded (e.g., `appsdev-apps-dev-script-auth@system.gserviceaccount.com` which needs the Owner role). **Sample JSON output:** ```json { "bindings": [ { "members": ["serviceAccount:our-project-123@appspot.gserviceaccount.com"], "role": "roles/appengine.appAdmin" }, { "members": ["user:email1@gmail.com"], "role": "roles/owner" }, { "members": [ "serviceAccount:our-project-123@appspot.gserviceaccount.com", "serviceAccount:123456789012-compute@developer.gserviceaccount.com" ], "role": "roles/editor" } ], "etag": "BwUjMhCsNvY=", "version": 1 } ``` ## Expected Result No user-managed service accounts should have `*Admin`, `*admin`, `Editor`, or `Owner` roles assigned. ## Remediation **From Google Cloud Console** 1. Go to `IAM & admin/IAM` using `https://console.cloud.google.com/iam-admin/iam` 2. Under the `IAM` Tab look for `VIEW BY PRINCIPALS` 3. Filter `PRINCIPALS` using `type : Service account` 4. Look for the Service Account with the Principal nomenclature: `SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com` 5. Identify `User-Managed user created` service account with roles containing `*Admin` or `*admin` or role matching `Editor` or role matching `Owner` under `Role` Column. 6. Click on `Edit (Pencil Icon)` for the Service Account, it will open all the roles which are assigned to the Service Account. 7. Click the `Delete bin` icon to remove the role from the Principal (service account in this case). **From Google Cloud CLI** ```bash gcloud projects get-iam-policy PROJECT_ID --format json > iam.json ``` 1. Using a text editor, Remove `Role` which contains `roles/*Admin` or `roles/*admin` or matched `roles/editor` or matches `roles/owner`. Add a role to the bindings array that defines the group members and the role for those members. For example, to grant the role `roles/appengine.appViewer` to the `ServiceAccount` which is `roles/editor`, you would change the example shown below as follows: ```json { "bindings": [ { "members": ["serviceAccount:our-project-123@appspot.gserviceaccount.com"], "role": "roles/appengine.appViewer" }, { "members": ["user:email1@gmail.com"], "role": "roles/owner" }, { "members": [ "serviceAccount:our-project-123@appspot.gserviceaccount.com", "serviceAccount:123456789012-compute@developer.gserviceaccount.com" ], "role": "roles/editor" } ], "etag": "BwUjMhCsNvY=" } ``` 2. Update the project's IAM policy: ```bash gcloud projects set-iam-policy PROJECT_ID iam.json ``` ## Default Value User Managed (and not user-created) default service accounts have the `Editor (roles/editor)` role assigned to them to support GCP services they offer. By default, there are no roles assigned to `User Managed User created` service accounts. ## Additional Information Default (user-managed but not user-created) service accounts have the `Editor (roles/editor)` role assigned to them to support GCP services they offer. Such Service accounts are: `PROJECT_NUMBER-compute@developer.gserviceaccount.com`, `PROJECT_ID@appspot.gserviceaccount.com`. ## References 1. https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/ 2. https://cloud.google.com/iam/docs/understanding-roles 3. https://cloud.google.com/iam/docs/understanding-service-accounts ## CIS Controls | Controls Version | Control | IG 1 | IG 2 | IG 3 | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- | | v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts - Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account. | x | x | x | | v7 | 4.3 Ensure the Use of Dedicated Administrative Accounts - Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities. | x | x | x |