{
  "Provider": "gcp",
  "CheckID": "iam_sa_no_administrative_privileges",
  "CheckTitle": "Ensure Service Account does not have admin privileges",
  "CheckType": [],
  "ServiceName": "iam",
  "SubServiceName": "",
  "ResourceIdTemplate": "",
  "Severity": "high",
  "ResourceType": "ServiceAccount",
  "Description": "Ensure Service Account does not have admin privileges",
  "Risk": "Enrolling ServiceAccount with Admin rights gives full access to an assigned application or a VM. A ServiceAccount Access holder can perform critical actions, such as delete and update change settings, without user intervention.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "https://docs.bridgecrew.io/docs/bc_gcp_iam_4#cli-command",
      "NativeIaC": "",
      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudIAM/restrict-admin-access-for-service-accounts.html",
      "Terraform": "https://docs.bridgecrew.io/docs/bc_gcp_iam_4#terraform"
    },
    "Recommendation": {
      "Text": "Ensure that your Google Cloud user-managed service accounts are not using privileged (administrator) roles, in order to implement the principle of least privilege and prevent any accidental or intentional modifications that may lead to data leaks and/or data loss.",
      "Url": "https://cloud.google.com/iam/docs/manage-access-service-accounts"
    }
  },
  "Categories": [],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
