Compute Engine instances should not use the default service account
Instances should not be configured to use the Default Service Account. Compute Engine VMs are evaluated for use of the default service account. The finding highlights instances configured with that account rather than a workload-specific service account.
Using the default service account often grants project-wide rights (e.g., roles/editor). If a VM is compromised, metadata tokens can be abused to read/modify resources, exfiltrate data, and pivot across services. The default service account has full project access.
What this control checks
Compute Engine instances must run under a service account other than the default one
Common pitfalls
GKE node VMs are ignored
GKE node VMs are ignored.
Names starting with gke- pass
if 'name' in conf and conf['name'][0].startswith('gke-'): return CheckResult.PASSED
Email must be defined and not empty
Additionally, 'email' must not be empty and must also not be a default Google Compute Engine service account.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_instance_default_service_account_in_use (prowler gcp --checks compute_instance_default_service_account_in_use); PowerPipe control gcp_compliance.control.compute_instance_with_no_default_service_account.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_30; KICS query "Using Default Service Account" (3cb4af0b-056d-4fb1-8b95-fdc4593625ff); Trivy check GCP-0044.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...) and CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...).
PCI DSS v4.0: Mapped to 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.5 (Access to system components and data is appropriately defined and assigned.), 7.3.3 (Access to system components and data is managed via an access control system(s).) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;).
NIST SP 800-53 Rev 5: Mapped to IA-5 (Authenticator Management).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-01 (Inventories of hardware managed by the organization are maintained.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 5 Supply chain security
- IA-5: Authenticator Management
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- 4.1 Ensure That Instances Are Not Configured To Use the Default Service Account
- 4.1 Ensure That Instances Are Not Configured To Use the Default Service Account
- 4.1 Ensure that instances are not configured to use the default service account
- 4.1 Ensure that instances are not configured to use the default service account
- 4.1 Ensure that instances are not configured to use the default service account
NIST Cybersecurity Framework v1.0
- PR.AC-1: Identities and credentials are issued, managed, verified, revoked, andaudited for authorized devices, users and processes.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_with_no_default_service_account - Checkov Check:
CKV_GCP_30 - Powerpipe Control:
gcp_compliance.control.compute_instance_with_no_default_service_account - Prowler Check:
compute_instance_default_service_account_in_use - KICS Query:
3cb4af0b-056d-4fb1-8b95-fdc4593625ff - Trivy Check:
GCP-0044
Last reviewed: 2026-10-09