Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should not use the default service account for project access
Kubernetes Engine Clusters should not be configured to use the default service account. GKE clusters are evaluated for use of the Compute Engine default service account as the node identity. Node pools should use dedicated, minimally privileged IAM service accounts.
What this control checks
Fails GKE clusters that use the default service account for project access
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
Related controls
- Compute Engine instances should not use the default service account with full access to all Cloud APIs
- Service accounts should not have Admin privileges
- IAM users should not have Service Account User or Service Account Token Creator roles at project level
- GKE clusters should have 'Master authorized networks' set to 'Enabled'
- GKE clusters should have database encryption enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
disable_gke_default_service_account - Powerpipe Control:
gcp_compliance.control.disable_gke_default_service_account - Prowler Check:
gke_cluster_no_default_service_account - KICS Query:
1c8eef02-17b1-4a3e-b01d-dcc3292d2c38
Last reviewed: 2026-10-09