Publicly accessible Google Compute instance uses a privileged service account

Docs > Datadog Security > OOTB Rules > Publicly accessible Google Compute instance uses a privileged service account

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

A publicly accessible VM instance has a Service Account with a privileged or administrative IAM policy. If an attacker retrieves the VM instance credentials through a vulnerability or other misconfiguration, they can compromise the victim’s Google Cloud project resources.

Remediation

Identify the service account assigned to the VM instance.
Identify effective permissions using Policy Analyzer.
Scope the policy to grant only the permissions that are required based on Google Cloud Role recommendations.