Back to Checks
gcp

GKE cluster does not use the Compute Engine default service account

gke_cluster_no_default_service_account
Service: gkeSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:container.googleapis.com/Cluster

GKE clusters are evaluated for use of the Compute Engine default service account (default) as the node identity. The expectation is that clusters and node pools run with dedicated, minimally privileged IAM service accounts instead of the project-wide default.

Prowler logoProwlerprowler-provider-gcp

Risk

Default node service accounts often have broad project access. If a node is compromised, its credentials can read secrets, modify resources, or delete infrastructure, enabling lateral movement and data exfiltration. This harms confidentiality, integrity, and availability across the environment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks gke_cluster_no_default_service_account

Recommendation

Assign a custom, least-privileged IAM service account to each node pool instead of default.

  • Grant only permissions required for node logging/monitoring and operations
  • Enforce separation of duties and restrict impersonation
  • Periodically review roles and audit usage for defense in depth

Remediation

CLI

gcloud container node-pools create <example_resource_name> --cluster=<example_resource_name> --location <example_resource_name> --service-account=<example_resource_name>@<example_resource_id>.iam.gserviceaccount.com

Terraform

resource "google_container_node_pool" "<example_resource_name>" {
  name     = "<example_resource_name>"
  cluster  = "<example_resource_name>"
  location = "<example_resource_name>"

  node_config {
    service_account = "<example_resource_name>@<example_resource_id>.iam.gserviceaccount.com" # critical: use a custom SA, not the Compute Engine default
  }
}

Other

1In Google Cloud Console, go to Kubernetes Engine > Clusters and open your cluster
2Click Add node pool
3In Security > Service account, select your non-default service account and click Create
4In Nodes > Node Pools, delete the node pool(s) that show Service account = default

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.gke.gke_client import gke_client


class gke_cluster_no_default_service_account(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for cluster in gke_client.clusters.values():
            report = Check_Report_GCP(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = f"GKE cluster {cluster.name} is not using the Compute Engine default service account."
            if not cluster.node_pools and cluster.service_account == "default":
                report.status = "FAIL"
                report.status_extended = f"GKE cluster {cluster.name} is using the Compute Engine default service account."
            for node_pool in cluster.node_pools:
                if node_pool.service_account == "default":
                    report.status = "FAIL"
                    report.status_extended = f"GKE cluster {cluster.name} is using the Compute Engine default service account."
                break
            findings.append(report)

        return findings

References