Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should not use the default service account with full access to all Cloud APIs
Instances should not use the default service account with the cloud-platform scope (Allow full access to all Cloud APIs). Prowler flags Compute Engine VM instances using the default service account with that scope. GKE nodes are excluded.
What this control checks
Fails if a VM uses the default service account with the cloud-platform scope
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- A.8.3 Information access restriction
- 5 Supply chain security
- IA-5: Authenticator Management
- 4.1 Ensure That Instances Are Not Configured To Use the Default Service Account
- 4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs
- 4.1 Ensure That Instances Are Not Configured To Use the Default Service Account
- 4.2 Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
5 more clauses
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- 4.2 Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
- 4.2 Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
- 4.1 Ensure that instances are not configured to use the default service account
- 4.2 Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
NIST Cybersecurity Framework v1.0
- PR.AC-1: Identities and credentials are issued, managed, verified, revoked, andaudited for authorized devices, users and processes.
- Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_with_no_default_service_account_with_full_access - Checkov Checks:
CKV_GCP_30,CKV_GCP_31 - Powerpipe Controls:
gcp_compliance.control.compute_instance_with_no_default_service_account,gcp_compliance.control.compute_instance_with_no_default_service_account_with_full_access - Prowler Checks:
compute_instance_default_service_account_in_use,compute_instance_default_service_account_in_use_with_full_api_access - KICS Queries:
3cb4af0b-056d-4fb1-8b95-fdc4593625ff,bc280331-27b9-4acb-a010-018e8098aa5d - Trivy Check:
GCP-0044
Last reviewed: 2026-10-09