Publicly accessible Google Compute instance uses a privileged service account

문서 > Datadog 보안 > OOTB Rules > Publicly accessible Google Compute instance uses a privileged service account

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

A publicly accessible VM instance has a Service Account with a privileged or administrative IAM policy. If an attacker retrieves the VM instance credentials through a vulnerability or other misconfiguration, they can compromise the victim’s Google Cloud project resources.

Remediation

Identify the service account assigned to the VM instance.
Identify effective permissions using Policy Analyzer.
Scope the policy to grant only the permissions that are required based on Google Cloud Role recommendations.