Google Cloud Compliance ControlsGoogle Cloud IAM
Service accounts should not have Admin privileges
Checks whether a `ServiceAccount` has admin access. A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. It's recommended not to use admin access for a `ServiceAccount`.
What this control checks
Checks IAM service accounts for Admin privileges
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.3: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
9 more clauses
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 8.3.4: Strong authentication for users and administrators is established and managed.
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- A.8.3 Information access restriction
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AC-6: Least Privilege
NIST Cybersecurity Framework v2.0
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
- 1.5 Ensure That Service Account Has No Admin Privileges
- 1.5 Ensure That Service Account Has No Admin Privileges
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
- 1.5 Ensure that Service Account has no Admin privileges
- 1.5 Ensure that Service Account has no Admin privileges
- 1.5 Ensure that Service Account has no Admin privileges
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_service_account_without_admin_privilege - Powerpipe Control:
gcp_compliance.control.iam_service_account_without_admin_privilege - Prowler Check:
iam_sa_no_administrative_privileges
Last reviewed: 2026-10-09