lacework-global-265
Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs (Automated)
Profile Applicability
• Level 1
Description
To support principle of least privileges and prevent potential privilege escalation, best practices recommend that instances are not assigned to default service account Compute Engine default service account
with Scope Allow full access to all Cloud APIs
.
Rationale
Along with ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account Compute Engine default service account
for an instances to access necessary cloud services.
Project Editor
role is assigned to Compute Engine default service account
hence, This service account has almost all capabilities over all cloud services except billing.
However, when Compute Engine default service account
assigned to an instance it can operate in 3 scopes.
1. Allow default access: Allows only minimum access required to run an Instance (Least Privileges)
2. Allow full access to all Cloud APIs: Allow full access to all the cloud APIs/Services (Too much access)
3. Set access for each API: Allows Instance administrator to choose only those APIs that are needed to perform specific business functionality expected by instance
When an instance is configured with Compute Engine default service account
with Scope Allow full access to all Cloud APIs
, based on IAM roles assigned to the user(s) accessing Instance, it may allow user to perform cloud operations/API calls that user is not supposed to perform leading to successful privilege escalation.
Impact
In order to change service account or scope for an instance, it needs to be stopped.
Audit
From Console:
- Go to the
VM instances
page by visiting: https://console.cloud.google.com/compute/instances. - Click on each instance name to go to its
VM instance details
page. - Under the
API and identity management
, ensure thatCloud API access scopes
is not set toAllow full access to all Cloud APIs
.
From Command Line:
- List the instances in your project and get details on each instance:
gcloud compute instances list --format=json | jq -r '. | "SA Scopes: \(.[].serviceAccounts[].scopes) Name: \(.[].name)"'
- Ensure that the service account section has an email that does not match the pattern
[PROJECT_NUMBER]-compute@developer.gserviceaccount.com
.
Exception:
VMs created by GKE should be excluded. These VMs have names that start with gke-
and are labeled `goog-gke-node
Remediation
From Console:
- Go to the
VM instances
page by visiting: https://console.cloud.google.com/compute/instances. - Click the impacted VM instance.
- If the instance is not stopped, click the
Stop
button. Wait for the instance to stop. - Next, click the
Edit
button. - Scroll down to the
Service Account
section. - Select a different service account or ensure that
Allow full access to all Cloud APIs
is not selected. - Click the
Save
button to save your changes and then clickStart
.
From Command Line:
- Stop the instance:
gcloud compute instances stop <instance_name>
- Update the instance:
gcloud compute instances set-service-account <instance_name> --service-account=<SERVICE_ACCOUNT> --scopes [SCOPE1, SCOPE2]
- Restart the instance:
gcloud compute instances start <instance_name>
References
https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances
https://cloud.google.com/compute/docs/access/service-accounts
Additional Information
- User Identity and Access Management (IAM) roles override service account scope but configuring minimal scope ensures defense in depth
- Non-default service accounts do not offer selection of access scopes like default service account. Use IAM roles with non-default service accounts to control VM access.