# 1.5 Ensure Service Accounts Do Not Have Admin Privileges (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232881-15-ensure-service-accounts-do-not-have-admin-privileges-automated - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability:Level 1 Description: Service accounts are special Google accounts assigned to applications or virtual machines (VMs) to interact with Google Cloud services. These accounts should not have administrative privileges such as Owner, Editor, or Admin roles to minimize the risk of unauthorized changes or critical actions being performed without user intervention. Rationale: Granting admin privileges to service accounts can: 1. Provide excessive access to resources, which may lead to unintended modifications or deletions. 2. Increase the risk of misuse or exploitation in case the service account credentials are compromised. To enhance security, service accounts should only be assigned the minimum roles necessary for their tasks. Impact: Removing admin or elevated roles (e.g., Owner, Editor, Admin) from service accounts may disrupt the functionality of applications or VMs that rely on these roles. Ensure required roles are assigned to maintain functionality. Default Value: By default: - Default user-managed service accounts (e.g., PROJECT\_NUMBER compute@developer.gserviceaccount.com, PROJECT\_ID@appspot.gserviceaccount.com) are assigned the Editor role to support specific GCP services. - User-created service accounts have no roles assigned by default. Remediation Steps: Using Google Cloud Console: 1. Navigate to IAM & Admin > IAM at [GCP IAM Console](https://console.cloud.google.com/iam-admin/iam). 2. Use the "View by Principals" filter to display Service Accounts. 3. Identify service accounts with roles such as \*Admin, Editor, or Owner. Using Google Cloud CLI: Retrieve the IAM policy for the project:  gcloud projects get-iam-policy --format json > iam.json 1. Review the bindings section in the output JSON. Check the roles assigned to service accounts. - Ensure no roles include \*Admin, Editor, or Owner. Implementation: Using Google Cloud Console: 1. Navigate to IAM & Admin > IAM at [GCP IAM Console](https://console.cloud.google.com/iam-admin/iam). 2. Filter by Service Accounts to identify accounts with elevated roles. 3. For each service account: - Click the Edit (Pencil) icon next to the account. - Remove roles containing \*Admin, Editor, or Owner by clicking the Delete (Trash) icon. Using Google Cloud CLI: Retrieve the current IAM policy:  gcloud projects get-iam-policy --format json > iam.json Edit the iam.json file to replace elevated roles with appropriate least-privilege roles. Example: Replace roles/editor with roles/appengine.appViewer. { "bindings": \[ { "members": \[ "serviceAccount:example@appspot.gserviceaccount.com" \], "role": "roles/appengine.appViewer" } \], "etag": "BwUjMhCsNvY=" } Update the IAM policy with the modified file:  gcloud projects set-iam-policy iam.json Backout Plan: 1\. Reassign Required Roles (If Necessary) If an application fails due to missing permissions, reassign a necessary role: gcloud projects add-iam-policy-binding \\ --member="serviceAccount:my-service-account@my-project.iam.gserviceaccount.com" \\ --role="roles/" 2\. Restore Previous IAM Policy If necessary, restore a previous IAM policy: gcloud projects set-iam-policy backup-iam.json References: 1. [Managing Service Accounts](https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/) 2. [Understanding IAM Roles](https://cloud.google.com/iam/docs/understanding-roles) 3. [Service Account Best Practices](https://cloud.google.com/iam/docs/understanding-service-accounts) CIS Controls:

Control

Description

IG 1

IG 2

IG 3

5.4 Restrict Administrator Privileges

Ensure admin privileges are restricted to dedicated accounts, avoiding over-permissive service accounts.

✅

✅

✅

4.3 Use Dedicated Administrative Accounts

Require administrative activities to be performed using dedicated accounts, reducing the risk of misuse.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.