Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level

SrednjaNivo 1Ručni pregledgcp

Opis

It is recommended to assign the Service Account User (iam.serviceAccountUser) and Service Account Token Creator (iam.serviceAccountTokenCreator) roles to a user for a specific service account rather than assigning the role to a user at project level. A service account is a special Google account that belongs to an application or a virtual machine (VM), instead of to an individual end-user. Application/VM-Instance uses the service account to call the service's Google API so that users aren't directly involved. In addition to being an identity, a service account is a resource that has IAM policies attached to it. These policies determine who can use the service account. Users with IAM roles to update the App Engine and Compute Engine instances (such as App Engine Deployer or Compute Instance Admin) can effectively run code as the service accounts used to run these instances, and indirec...

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

From Google Cloud Console 1. Go to the IAM page in the GCP Console by visiting https://console.cloud.google.com/iam-admin/iam 2. Click on the filter table text bar, Type Role: Service Account User. 3. Ensure no user is listed as a result of the filter. 4. Click on the filter table text bar, Type Role: Service Account Token Creator. 5. Ensure no user is listed as a result of the filter. From Google Cloud CLI To ensure IAM users are not assigned Service Account User role at the project level: gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep "roles/iam.serviceAccountUser" gcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep "roles/iam.serviceAccountTokenCreator" These commands should not return any output.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

From Google Cloud Console 1. Go to the IAM page in the GCP Console by visiting: https://console.cloud.google.com/iam-admin/iam. 2. Click on the filter table text bar. Type Role: Service Account User 3. Click the Delete Bin icon in front of the role Service Account User for every user listed as a result of a filter. 4. Click on the filter table text bar. Type Role: Service Account Token Creator 5. Click the Delete Bin icon in front of the role Service Account Token Creator for every user listed as a result of a filter. From Google Cloud CLI 1. Using a text editor, remove the bindings with the roles/iam.serviceAccountUser or roles/iam.serviceAccountTokenCreator. For example, you can use the iam.json file shown below as follows: { "bindings": [ { "members": [ "serviceAccount:our-project-123@appspot.gserviceaccount.com", ], "role": "roles/appengine.appViewer" }, { "members": [ "user:email1@gmail.com" ], "role": "roles/owner" }, { "members": [ "serviceAccount:our-project-123@appspot.gserviceaccount.com", "serviceAccount:123456789012-compute@developer.gserviceaccount.com" ], "role": "roles/editor" } ], "etag": "BwUjMhCsNvY=" } 2. Update the project's IAM policy: gcloud projects set-ia...

Svojstva

Operativni sistemi: Bilo koji
Oznake: authcloudgcpiam
Referenca: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 1.7 Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level