Posture check: GCP VM instances with excessive service account permissions
Query: ```config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = name does not start with "gke-" and status equals RUNNING as X; config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' as Y; filter '($.X.serviceAccounts[*].email equals $.Y.user) and not($.Y.roles[*] contains projects or $.Y.roles[*] all equal roles/viewer)'; show X;```