Skip to content

Google Cloud access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Google Cloud, Black Cat runs 30 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Google Cloud connector needs.

Checks (30)

severity: critical Overly Permissive IAM Binding fix difficulty: hard #

Replace overly permissive GCP IAM bindings with least-privilege predefined or custom roles

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Identify bindings using roles/editor or roles/owner on broad principals
  3. Replace with least-privilege predefined or custom roles
  4. Test workloads to confirm they still function correctly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.2 CIS Controls v8 CIS-05.4 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high SA Impersonation Role Binding fix difficulty: hard #

Remove or scope down GCP IAM bindings that grant service account impersonation roles

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Find bindings granting iam.serviceAccountTokenCreator or iam.serviceAccountUser
  3. Remove the binding or scope it to a specific service account
  4. Verify workloads do not break after the change

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Project Owners fix difficulty: medium #

Reduce the number of GCP project Owners by removing users who do not require that role

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Identify principals with the Owner role
  3. Remove Owner role from users who do not require it
  4. Assign more specific roles as needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Owner Role Group Assignment fix difficulty: medium #

Replace GCP group-based Owner role bindings with less permissive roles or individual assignments

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Identify group principals bound to the Owner role
  3. Replace with a more restrictive role or assign Owner to specific individuals only
  4. Audit group membership to ensure only trusted members are included

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Privileged Service Account Binding fix difficulty: hard #

Replace privileged GCP IAM role bindings for service accounts with least-privilege roles

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Identify privileged role bindings assigned to service accounts
  3. Replace with least-privilege roles scoped to required resources
  4. Test service account workloads after changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Old Service Account Keys fix difficulty: medium #

Rotate GCP service account keys older than 90 days and delete the old keys

  1. Navigate to GCP Console > IAM & Admin > Service Accounts
  2. Select the service account with old keys
  3. Create a new key and update dependent applications
  4. Delete the old key once the new key is confirmed working

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC7.1 CIS Controls v8 CIS-07.4 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium User Managed Service Account Keys fix difficulty: hard #

Migrate GCP workloads from user-managed service account keys to Workload Identity Federation

  1. Navigate to GCP Console > IAM & Admin > Service Accounts
  2. Identify service accounts with user-managed keys
  3. Migrate workloads to use Workload Identity Federation or attached service accounts
  4. Delete the user-managed keys once migration is complete

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC7.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Bucket Uniform Access Disabled fix difficulty: medium #

Enable uniform bucket-level access on GCP Storage buckets and migrate ACLs to IAM policies

  1. Navigate to GCP Console > Cloud Storage > Buckets
  2. Select the bucket without uniform access
  3. Go to the Permissions tab
  4. Enable uniform bucket-level access
  5. Migrate any existing ACLs to IAM policies

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC8.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high SA Key Creation Not Disabled fix difficulty: medium #

Enable the GCP organization policy to disable service account key creation

  1. Navigate to GCP Console > IAM & Admin > Organization Policies
  2. Search for constraints/iam.disableServiceAccountKeyCreation
  3. Enable the constraint to disable service account key creation
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium SA Key Upload Not Disabled fix difficulty: easy #

Enable the GCP organization policy to disable service account key uploads

  1. Navigate to GCP Console > IAM & Admin > Organization Policies
  2. Search for constraints/iam.disableServiceAccountKeyUpload
  3. Enable the constraint to disable service account key uploads
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Default SA Grant Not Disabled fix difficulty: medium #

Enable the GCP org policy to prevent automatic IAM grants for default service accounts

  1. Navigate to GCP Console > IAM & Admin > Organization Policies
  2. Search for constraints/iam.automaticIamGrantsForDefaultServiceAccounts
  3. Enable the constraint to prevent automatic IAM grants for default service accounts
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC5.2 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Service Account Key Expiry Not Enforced fix difficulty: medium #

Configure the GCP org policy to expire user-managed service account keys

  1. Navigate to GCP Console > IAM & Admin > Organization Policies
  2. Search for constraints/iam.serviceAccountKeyExpiryHours
  3. Set a maximum key validity duration (e.g. 2160h / 90 days)
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Unrestricted API Key fix difficulty: medium #

Add API and application restrictions to GCP API keys to limit their scope

  1. Navigate to GCP Console > APIs & Services > Credentials
  2. Select the unrestricted API key
  3. Add API restrictions to limit which APIs the key can call
  4. Add application restrictions (IP, HTTP referrer, or app) as appropriate
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.1 CIS Controls v8 CIS-07.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Stale API Key fix difficulty: easy #

Delete stale GCP API keys that have not been used recently

  1. Navigate to GCP Console > APIs & Services > Credentials
  2. Identify API keys that have not been used recently
  3. Verify with teams that the key is no longer needed
  4. Delete the stale API key

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.1 CIS Controls v8 CIS-07.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high KMS Separation of Duties Violation fix difficulty: medium #

Remove conflicting GCP KMS roles to enforce separation of duties between admins and encrypters

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Identify users who have both KMS admin and encrypter/decrypter roles
  3. Remove one of the conflicting roles from each user
  4. Assign roles to separate individuals to enforce separation of duties

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.2 SOC 2 Type II CC5.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 ID.RA GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high SA Separation of Duties Violation fix difficulty: medium #

Remove conflicting GCP service account roles to enforce separation of duties

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Identify users who have both service account admin and service account user roles
  3. Remove one of the conflicting roles from each user
  4. Assign roles to separate individuals to enforce separation of duties

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.2 SOC 2 Type II CC5.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 ID.RA GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Org-Level Owner Binding fix difficulty: hard #

Remove org-level Owner role bindings in GCP and grant Owner only at the project level

  1. Navigate to GCP Console > IAM & Admin > IAM (organization level)
  2. Identify principals with Owner role at the organization level
  3. Remove the org-level Owner binding
  4. Grant Owner only at the project level where needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.1 CIS Controls v8 CIS-05.4 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Org-Level Editor Binding fix difficulty: hard #

Remove org-level Editor role bindings in GCP and replace with project-level specific roles

  1. Navigate to GCP Console > IAM & Admin > IAM (organization level)
  2. Identify principals with Editor role at the organization level
  3. Remove the org-level Editor binding
  4. Grant more specific roles at the project level

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.1 CIS Controls v8 CIS-05.4 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high External Members at Org Level fix difficulty: medium #

Remove external members from GCP organization-level IAM bindings

  1. Navigate to GCP Console > IAM & Admin > IAM (organization level)
  2. Identify external members (accounts outside your domain)
  3. Remove external member bindings at the organization level
  4. If access is required, grant it at the project level with limited roles

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.1 CIS Controls v8 CIS-15.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Instance Uses Default Service Account fix difficulty: medium #

Replace the default Compute Engine service account with a custom least-privilege service account (CIS GCP 4.1)

  1. Navigate to GCP Console > Compute Engine > VM Instances
  2. Select the flagged instance and click Edit
  3. Under Service account, select a custom service account with only the roles required by the workload
  4. Save changes and restart the instance if necessary
  5. Delete or disable the unused default compute service account bindings if no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Cloud KMS Key Publicly Accessible fix difficulty: easy #

Remove public IAM members (allUsers, allAuthenticatedUsers) from Cloud KMS crypto keys

  1. Navigate to GCP Console > Security > Key Management
  2. Select the flagged key ring and crypto key
  3. Open the Permissions tab
  4. Remove allUsers and allAuthenticatedUsers from all IAM bindings
  5. Grant access only to specific service accounts or users as required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Secret Manager Secret Publicly Accessible fix difficulty: easy #

Remove public IAM members (allUsers, allAuthenticatedUsers) from Secret Manager secrets

  1. Navigate to GCP Console > Security > Secret Manager
  2. Select the flagged secret and open the Permissions tab
  3. Remove allUsers and allAuthenticatedUsers from all IAM bindings
  4. Grant access only to specific service accounts or users as required
  5. Verify workloads still function with the restricted bindings

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.6 NIST CSF 2.0 PR.DS-01 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical GKE Legacy ABAC Enabled fix difficulty: medium #

Disable legacy Attribute-Based Access Control and use RBAC for GKE cluster authorization (CIS GKE 6.2.1)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Security, disable Legacy Authorization (ABAC)
  4. Save changes — existing ABAC policies will no longer take effect
  5. Review Kubernetes RBAC roles and bindings to ensure equivalent access is granted

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high GKE Workload Identity Disabled fix difficulty: medium #

Enable Workload Identity to bind Kubernetes service accounts to GCP IAM service accounts without key files (CIS GKE 6.2.2)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Security, enable Workload Identity
  4. Save changes
  5. Update workloads to use Kubernetes service accounts annotated with their corresponding GCP IAM service account

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high GKE Master Authorized Networks Disabled fix difficulty: easy #

Enable master authorized networks to restrict GKE control plane access to specific CIDR ranges (CIS GKE 6.6.3)

  1. Navigate to GCP Console > Kubernetes Engine > Clusters
  2. Select the flagged cluster and click Edit
  3. Under Networking, enable Control plane authorized networks
  4. Add the CIDR ranges for your corporate network, VPN, or bastion hosts
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Unbounded Conditional Privileged Binding fix difficulty: medium #

Add a time bound to conditional grants of privileged GCP roles, or remove the grant

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Locate the binding for the reported role and open its condition
  3. Add a request.time upper bound (for example, request.time < timestamp("2026-12-31T23:59:59Z"))
  4. If the access is meant to be permanent, remove the condition and justify the grant through access review instead
  5. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical WIF Provider Trusts Public Issuer Without Attribute Condition fix difficulty: medium #

Restrict a workload identity provider that trusts a multi-tenant OIDC issuer with an attribute condition

  1. Navigate to GCP Console > IAM & Admin > Workload Identity Federation
  2. Open the flagged pool and provider
  3. Add an attribute condition that scopes trust to a specific repository, organization, or subject claim
  4. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high WIF Provider Missing Attribute Condition fix difficulty: medium #

Add an attribute condition to a workload identity provider so it does not accept every identity it trusts

  1. Navigate to GCP Console > IAM & Admin > Workload Identity Federation
  2. Open the flagged pool and provider
  3. Add an attribute condition scoping which identities from the issuer are accepted
  4. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Privileged Service Account Impersonable From Unconditioned WIF Pool fix difficulty: hard #

Remove the privileged role from this service account or add an attribute condition to the workload identity pool that can impersonate it

  1. Navigate to GCP Console > IAM & Admin > Workload Identity Federation
  2. Identify the pool and provider granted iam.workloadIdentityUser on this service account
  3. Add an attribute condition to the provider, or scope the workloadIdentityUser binding to specific identities
  4. Alternatively, remove the privileged project role from this service account
  5. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Privileged Role Granted to Workload Identity Pool via Wildcard fix difficulty: hard #

Replace a principalSet wildcard IAM binding on a privileged role with an attribute-scoped grant

  1. Navigate to GCP Console > IAM & Admin > IAM
  2. Locate the binding granting the privileged role to the principalSet wildcard
  3. Replace the wildcard member with an attribute-scoped principalSet, or remove the binding
  4. Re-run the scan to confirm the finding clears

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Google Cloud checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial