---
title: >-
  Instances should be configured to use a non-default service account with
  restricted API access
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Instances should be configured to use a
  non-default service account with restricted API access
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Instances should be configured to use a non-default service account with restricted API access
 
## Description{% #description %}

This rule fails when an instance uses the Compute Engine default service account (`PROJECT_NUMBER-compute@developer.gserviceaccount.com`) with the `https://www.googleapis.com/auth/cloud-platform` access scope, which the console calls "Allow full access to all Cloud APIs". The default service account can hold the project Editor role, so this scope lets anything running on the instance use those permissions against every Cloud API, which can lead to privilege escalation. The check matches the full-access scope exactly: narrower scopes such as `https://www.googleapis.com/auth/cloud-platform.read-only` pass, and so do instances that use a user-managed service account. GKE nodes, identified by a name starting with `gke-` together with a `goog-k8s-cluster-name` label, are skipped.

## Remediation{% #remediation %}

1. Stop the instance.
1. Attach a user-managed service account that has only the roles the workload needs, or keep the default service account and select narrower access scopes, following [Attach the service account and update the access scope](https://docs.cloud.google.com/compute/docs/instances/change-service-account#changeserviceaccountandscopes).
1. Start the instance.

## References{% #references %}

- [Service accounts](https://docs.cloud.google.com/compute/docs/access/service-accounts)
- [Change the attached service account](https://docs.cloud.google.com/compute/docs/instances/change-service-account#changeserviceaccountandscopes)
- [CIS Google Cloud Platform Foundation Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)