# 4.1 Ensure Instances Are Not Configured To Use the Default Service Account (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233015-4-1-ensure-instances-are-not-configured-to-use-the-default-service-account-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 1 ### Description: Instances should not use the default Compute Engine service account as it has broad permissions with the Editor role (roles/editor) across the project. Instead, instances should be assigned a custom service account with only the necessary permissions. ### Rationale: The default Compute Engine service account is automatically granted the Editor role, providing read and write access to most Google Cloud services. This level of access poses a security risk, as a compromised VM could lead to privilege escalation and unauthorized access to the entire project. By disabling the use of the default service account and assigning a custom service account with the principle of least privilege, the potential for privilege escalation is minimized. ### Default Value: By default, Compute Engine instances use the default Compute Engine service account: \[PROJECT\_NUMBER\]-compute@developer.gserviceaccount.com. ### Audit Steps: #### From Google Cloud Console: 1. Navigate to the VM Instances page: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).                    ![](https://support.icompaas.com/assets/kb/8bd9e8a61673cab9.png) 2. Click on each instance name to view its details. 3. Under API and Identity Management, confirm that the service account is not the default Compute Engine service account: \[PROJECT\_NUMBER\]-[compute@developer.gserviceaccount.com](mailto:compute@developer.gserviceaccount.com).                ![](https://support.icompaas.com/assets/kb/3403a243b1f5f019.png) #### From Google Cloud CLI: List all instances and their associated service accounts: gcloud compute instances list --format=json | jq -r '.\[\] | "Instance: \\(.name), Service Account: \\(.serviceAccounts\[\].email)"' 1. Ensure that the service account for each instance does not match the pattern: \[PROJECT\_NUMBER\]-compute@developer.gserviceaccount.com. ### Exceptions: - VMs created by GKE (Google Kubernetes Engine) are exempt. These VMs typically have names starting with gke- and are labeled with goog-gke-node. ### Remediation Steps: #### From Google Cloud Console: 1. Navigate to the VM Instances page: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).                              ![](https://support.icompaas.com/assets/kb/2592c32c9ee2cf3f.png) 2. Click on the instance name to view its details.                 ![](https://support.icompaas.com/assets/kb/b2b7afd9e4c582af.png) 3. Click STOP and then EDIT.                  ![](https://support.icompaas.com/assets/kb/a72d3e30c6530e9a.png) 4. Under API and Identity Management, select a custom service account other than the default Compute Engine service account - If a custom service account is not available, create one first. 5. Click Save, then START the instance.                   ![](https://support.icompaas.com/assets/kb/b7a722f02505cd85.png) ![](https://support.icompaas.com/assets/kb/26bb50641ef45254.png) #### From Google Cloud CLI: Stop the instance: gcloud compute instances stop INSTANCE\_NAME Assign a custom service account to the instance: gcloud compute instances set-service-account INSTANCE\_NAME --service-account=SERVICE\_ACCOUNT Restart the instance: gcloud compute instances start INSTANCE\_NAME ### References: 1. [Google Cloud Service Accounts Documentation](https://cloud.google.com/compute/docs/access/service-accounts) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

4.7 Manage Default Accounts

Manage default accounts on enterprise assets and software, such as root or administrator accounts.

✅

✅

✅

4.7 Limit Access to Script Tools

Limit access to scripting tools to authorized users only.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.