Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE cluster nodes should not use the default service account
This control ensures that GKE clusters nodes does not uses default service account. It is recommended to create and use a least privileged service account to run your GKE cluster instead of using the default service account.
What this control checks
GKE clusters nodes should not use default service account
Framework mappings
The clauses this control is mapped to in each framework.
- Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_node_no_default_service_account - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_node_no_default_service_account
Last reviewed: 2026-10-09