Publicly accessible Google Compute instance uses a privileged service account

google_compute_instance
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

A publicly accessible VM instance has a Service Account with a privileged or administrative IAM policy. If an attacker retrieves the VM instance credentials through a vulnerability or other misconfiguration, they can compromise the victim’s Google Cloud project resources.

Remediation

  1. Identify the service account assigned to the VM instance.
  2. Identify effective permissions using Policy Analyzer.
  3. Scope the policy to grant only the permissions that are required based on Google Cloud Role recommendations.