Compute Engine instances should have service account impersonation permissions restricted
This control ensures that Compute Instance does not allow service account impersonate permissions. The powerpipe check is titled "Compute Instances should restrict service account impersonate permission".
What this control checks
Compute Instances should restrict service account impersonate permission
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_instance_no_service_account_impersonate_permission.
Related controls
- Compute Engine instances should not use the default service account
- IAM users should not hold both service account admin and service account user roles
- Service account keys should limit age to 100 days
- Compute Engine instances should have IP forwarding disabled
- GCP projects should have OS Login 2FA enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_no_service_account_impersonate_permission - Powerpipe Control:
gcp_compliance.control.compute_instance_no_service_account_impersonate_permission
Last reviewed: 2026-10-09