gcp/no-editor-service-accounts

No service account holds Owner or Editor on a Google Cloud project, including the default Compute account.

highofficial

Install

firedrill hub add gcp/no-editor-service-accounts

Reads

gcp.projects, gcp.iam_bindings

Fix when it fails

Replace Owner or Editor on these service accounts with the narrow roles their workloads need. For the default Compute account, remove Editor and attach a dedicated service account to each VM.

Maps to

SOC2:CC6.3, ISO27001:A.8.2

Test cases

Case	Expected
only Google's agent has Editor	PASS
default compute account has Editor	FAIL
no bindings	N/A

Drill file

firedrill: v0
id: gcp/no-editor-service-accounts
safeguard: "No service account holds Owner or Editor on a Google Cloud project, including the default Compute account."
severity: high
for_each: gcp.projects
fetch:
  bindings: { fact: gcp.iam_bindings }
applies_when: bindings.size() > 0
na_reason: "the project has no IAM bindings"
pass_when:
  - >-
    bindings.filter(b, b.role in ["roles/owner", "roles/editor"] &&
    b.member_type in ["service_account", "deleted_service_account"] && !b.google_managed).size() == 0
fix: "Replace Owner or Editor on these service accounts with the narrow roles their workloads need. For the default Compute account, remove Editor and attach a dedicated service account to each VM."
maps_to: [SOC2:CC6.3, ISO27001:A.8.2]