Ensure Super Admin Account Is Not Used For Google Cloud Administration

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

From Google Cloud Admin Console 1. Navigate to Google Admin console at https://admin.google.com 2. Go to Account → Admin roles 3. Click on Super Admin role 4. Note all user accounts assigned the Super Admin role 5. Navigate to Google Cloud Console at https://console.cloud.google.com 6. Go to IAM & Admin → IAM 7. At the organization level, click the organization dropdown at the top and select your organization 8. In the Permissions tab, review all IAM policy bindings 9. Verify that: o None of the super admin user accounts identified in step 4 appear in the IAM permissions list o Super admin accounts have NO IAM roles granted at organization, folder, or project levels 10. To audit at folder and project levels: o Navigate to IAM & Admin → IAM for each folder o Navigate to IAM & Admin → IAM for each project o Verify super admin accounts do not appear in any IAM bindings

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

From Google Cloud Admin Console 1. Create Separate Regular User Account for GCP Administration o Navigate to Google Admin console at https://admin.google.com o Go to Directory → Users o Click Add new user o Create a regular user account (not a super admin) for GCP administration o Click Add new user o Configure additional security settings like enforcing 2-Step Verification o Important: Do NOT assign this user the Super Admin role in Workspace/Cloud Identity 2. Grant GCP IAM Roles to the Cloud Admin User Account o Navigate to Google Cloud Console at https://console.cloud.google.com o Go to IAM & Admin → IAM o Select your organization from the organization dropdown at the top o Click Grant Access o In the Add principals field, enter the regular user account created in Step 1 o In the Select a role dropdown, assign appropriate GCP IAM roles. Example - Organization Administrator for organization-level administration. Add other roles as needed based on responsibilities o Click Save 3. Delete All GCP IAM Bindings for Super Admin Users o Navigate to Google Cloud Console at https://console.cloud.google.com o Go to IAM & Admin → IAM at the organization level o Identify all super admin u...