GKE cluster nodes should not use the default service account
This control ensures that GKE clusters nodes does not uses default service account. It is recommended to create and use a least privileged service account to run your GKE cluster instead of using the default service account.
It is recommended to create and use a least privileged service account to run your GKE cluster instead of using the default service account.
What this control checks
GKE clusters nodes should not use default service account
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_node_no_default_service_account.
Framework-specific interpretation
PCI DSS v3.2.1: Mapped to 2.1 (Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on...).
Framework mappings
The clauses this control is mapped to in each framework.
- Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_node_no_default_service_account - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_node_no_default_service_account
Last reviewed: 2026-10-09