Service accounts should not have Admin privileges
Checks whether a `ServiceAccount` has admin access. A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user. It's recommended not to use admin access for a `ServiceAccount`.
Over-privileged service accounts jeopardize the CIA triad. Confidentiality: data can be read and exfiltrated. Integrity: configs, IAM, and code can be altered.
What this control checks
Checks IAM service accounts for Admin privileges
Common pitfalls
Roles containing admin also fail
The evaluation looks for service accounts bound to these roles in IAM policies across the project hierarchy. Google Cloud service accounts with high-privilege IAM roles are identified, including roles/owner, roles/editor, or any role containing admin.
Inherited roles need removal at higher levels
Repeat at folder/organization level if the role was inherited.
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_sa_no_administrative_privileges (prowler gcp --checks iam_sa_no_administrative_privileges); PowerPipe control gcp_compliance.control.iam_service_account_without_admin_privilege.
Framework-specific interpretation
SOC 2: Mapped to CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...).
PCI DSS v4.0: Mapped to 1.5.1 (Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.), 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.2 (Access to system components and data is appropriately defined and assigned.) and 11 more clauses.
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control), A.5.18 (Access Rights), A.8.2 (Privileged Access Rights) and 1 more clause.
NIS2 Directive (EU 2022/2555): Mapped to 11.1.2.c (ensure that access is only granted to users that have been adequately authenticated.), 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...) and 10 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-6 (Least Privilege).
NIST Cybersecurity Framework v2.0: Mapped to PR.AA-01 (Identities and credentials for authorized users, services, and hardware are managed by the organization.), PR.AA-03 (Users, services, and hardware are authenticated.) and PR.AA-05 (Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.3: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
9 more clauses
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.8: If a user session has been idle for more than 15 minutes, the user is required to re-authenticate to re-activate the terminal or session
- 8.3.4: Strong authentication for users and administrators is established and managed.
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- A.8.3 Information access restriction
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AC-6: Least Privilege
NIST Cybersecurity Framework v2.0
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
- 1.5 Ensure That Service Account Has No Admin Privileges
- 1.5 Ensure That Service Account Has No Admin Privileges
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
- 1.5 Ensure that Service Account has no Admin privileges
- 1.5 Ensure that Service Account has no Admin privileges
- 1.5 Ensure that Service Account has no Admin privileges
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_service_account_without_admin_privilege - Powerpipe Control:
gcp_compliance.control.iam_service_account_without_admin_privilege - Prowler Check:
iam_sa_no_administrative_privileges
Last reviewed: 2026-10-09