GKE clusters should not use the default service account for project access
Kubernetes Engine Clusters should not be configured to use the default service account. GKE clusters are evaluated for use of the Compute Engine default service account as the node identity. Node pools should use dedicated, minimally privileged IAM service accounts.
Default node service accounts often have broad project access. If a node is compromised, its credentials can read secrets, modify resources, or delete infrastructure, enabling lateral movement and data exfiltration.
What this control checks
Fails GKE clusters that use the default service account for project access
Audit evidence
Evidence that deployed resources meet this control: Prowler check gke_cluster_no_default_service_account (prowler gcp --checks gke_cluster_no_default_service_account).
Scans of the Terraform code that flag the same setting before deployment: KICS query "GKE Using Default Service Account" (1c8eef02-17b1-4a3e-b01d-dcc3292d2c38).
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;).
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
Related controls
- Compute Engine instances should not use the default service account with full access to all Cloud APIs
- Service accounts should not have Admin privileges
- IAM users should not have Service Account User or Service Account Token Creator roles at project level
- GKE clusters should have 'Master authorized networks' set to 'Enabled'
- GKE clusters should have database encryption enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
disable_gke_default_service_account - Powerpipe Control:
gcp_compliance.control.disable_gke_default_service_account - Prowler Check:
gke_cluster_no_default_service_account - KICS Query:
1c8eef02-17b1-4a3e-b01d-dcc3292d2c38
Last reviewed: 2026-10-09