Service Accounts

The Service Accounts page is specific to GCP, highlighting the risks linked to your GCP service accounts. You can utilize the detail drawers on this page to assess and address identity risks associated with individual service accounts and their permissions within your GCP environment.

Filter and Sort Service Accounts

Use the sortable columns to organize and filter service accounts for assessing identity risks. You can sort service accounts based on the following criteria:

Actionable Risk

Actionable Risk focuses on unused permissions, while Risk looks at all permissions. It is designed to help you achieve Least Permissive access.

Values: Critical, High, Medium, Low

Risk

This is a calculation of risk based on all permissions. See Understanding Risk Scoring for more information.

Values: Critical, High, Medium, Low

% of Unused Permissions

This shows the number of unused permissions per total permissions for the group, shown as a percentage graph.

When remediating, immediately target the groups with the greatest exposure and refine them according to the suggestions.

Highest Access

Values:

  • Admin: Admin access granted
  • Write: Write access granted
  • Read: Read access granted
  • Empty Access: No permissions are granted at all

See Understand Highest Access for more information.

Findings

A finding in Cloud Infrastructure Entitlement Management (CIEM) indicates poor security hygiene, either due to misconfiguration or inadequate identity security practices.

The findings for GCP accounts focus on highly permissive Google IAM roles and key management.

  • Admin: Admin access granted
  • Multiple Access Keys Active: Rotating access keys is safer than maintaining multiple active keys.
  • Editor Role Applied: The GCP Editor role includes permissions to create and delete resources for most Google Cloud services.
  • User-Managed Key: User-managed keys are less secure than Google-managed keys.
  • Lateral Movement: Sysdig leverages findings from the GCP Recommender Insights API to detect when a Service Account can move laterally from one project to another due to the roles/permissions it is granted.
  • Owner Role Applied: The GCP project owner role includes all Editor permissions plus many others.

Available Filters

  • Search: Free text search on terms in the resource name
  • Actionable Risks: By severity
  • Cloud Accounts: GCP cloud account name/number
  • Access Categories: Admin, Write, Read, or Empty Access
  • Findings: Admin , Multiple Access Keys Active, Editor Role Applied, User Managed Key, Lateral Movement, Owner Role Applied
Topics in This Section
Optimize GCP Service Account Entitlements

You can analyze and address identity risks associated with individual GCP service accounts and their permissionsby using the detailed drawers. Simply click on individual rows on the Service Accounts page to open the detailed drawer for further analysis.