Project: KICS (Provisioning / Security & Compliance)
File: 2775e169-e708-42a9-9305-b58aadd2c4dd.md

title: Using Default Service Account hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2775e169-e708-42a9-9305-b58aadd2c4dd Query name: Using Default Service Account Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Instances must not be configured to use the Default Service Account, that has full access to all Cloud APIs, which means the attribute 'serviceaccountemail' must be defined. Additionally, it must not be empty and must also not be a default Google Compute Engine service account.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="115 57 3 86" name: create a instance1 google.cloud.gcpcomputeinstance: name: test_object1 machine_type: n1-standard-1 disks: auto_delete: 'true' boot: 'true' source: "{{ disk }}" auto_delete: 'true' interface: NVME type: SCRATCH initialize_params: disk_type: local-ssd metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount state: present name: create a instance2 google.cloud.gcpcomputeinstance: name: test_object2 machine_type: n1-standard-1 disks: auto_delete: 'true' boot: 'true' source: "{{ disk }}" auto_delete: 'true' interface: NVME type: SCRATCH initialize_params: disk_type: local-ssd metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountemail: "" state: present name: create a instance3 google.cloud.gcpcomputeinstance: name: test_object3 machine_type: n1-standard-1 disks: auto_delete: 'true' boot: 'true' source: "{{ disk }}" auto_delete: 'true' interface: NVME type: SCRATCH initialize_params: disk_type: local-ssd metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountemail: "admin" state: present name: create a instance4 google.cloud.gcpcomputeinstance: name: test_object4 machine_type: n1-standard-1 disks: auto_delete: 'true' boot: 'true' source: "{{ disk }}" auto_delete: 'true' interface: NVME type: SCRATCH initialize_params: disk_type: local-ssd metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountemail: "admin@developer.gserviceaccount.com" state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: create a instance google.cloud.gcpcomputeinstance: name: test_object machine_type: n1-standard-1 disks: auto_delete: 'true' boot: 'true' source: '{{ disk }}' auto_delete: 'true' interface: NVME type: SCRATCH initialize_params: disk_type: local-ssd metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: '{{ network }}' access_configs: name: External NAT nat_ip: '{{ address }}' type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountemail: admin@admin.com state: present ```