Back to Checks
gcp

Compute Engine instance does not use the default service account with full access to all Cloud APIs

compute_instance_default_service_account_in_use_with_full_api_access
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:compute.googleapis.com/Instance

Compute Engine VM instances using the default service account with the cloud-platform scope (Allow full access to all Cloud APIs) are identified. GKE nodes are excluded.

Prowler logoProwlerprowler-provider-gcp

Risk

With full API scope, any code on the VM can obtain tokens and, combined with the service account's roles, call broad Google Cloud APIs. This enables privilege escalation, data exfiltration, unauthorized config changes, and service disruption, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_default_service_account_in_use_with_full_api_access

Recommendation

Use a custom, least-privileged service account per VM and avoid the default account. Restrict Cloud API scopes-prefer minimal or per-API scopes, not Allow full access to all Cloud APIs. Enforce least privilege and separation of duties, and regularly review roles to remove excessive permissions.

Remediation

Terraform

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "us-central1-a"

  boot_disk { initialize_params { image = "debian-cloud/debian-12" } }
  network_interface { network = "default" }

  service_account {
    email  = "<example_service_account_email>" # FIX: use a non-default service account to avoid the default SA
    scopes = ["https://www.googleapis.com/auth/devstorage.read_only"] # FIX: avoid cloud-platform (full API access)
  }
}

Other

1In Google Cloud Console, go to Compute Engine > VM instances
2Click the affected VM
3Click Stop and confirm
4Click Edit
5Under Service account, select a non-default service account (not <project-number>-compute@developer.gserviceaccount.com) OR change Cloud API access scopes to not use "Allow full access to all Cloud APIs" (use Default access or select specific APIs)
6Click Save
7Click Start to restart the VM

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_default_service_account_in_use_with_full_api_access(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"The VM Instance {instance.name} is not configured to use the default service account with full access to all cloud APIs."
            for service_account in instance.service_accounts:
                if (
                    "-compute@developer.gserviceaccount.com" in service_account["email"]
                    and "https://www.googleapis.com/auth/cloud-platform"
                    in service_account["scopes"]
                    and instance.name[:4] != "gke-"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"The VM Instance {instance.name} is configured to use the default service account with full access to all cloud APIs."
                    break
            findings.append(report)

        return findings

References