Control: GCP > Project > Organization Policy > Disable Automatic IAM Grants for Default Service Accounts

Manage the GCP Organization Policy "Disable Automatic IAM Grants for Default Service Accounts" for the project.

This boolean constraint, when enforced, prevents the default App Engine and Compute Engine service accounts that are created in your projects from being automatically granted any IAM role on the project when the accounts are created.

By default, these service accounts automatically receive the Editor role when they are created.

Resource Types

This control targets the following resource types:

GCP > Project

Primary Policies

The following policies can be used to configure this control:

Disable Automatic IAM Grants for Default Service Accounts

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-orgpolicy#/control/types/iamAutomaticIamGrantsForDefaultServiceAccounts

Category URI

tmod:@turbot/turbot#/control/categories/policy

GraphQL

query controlType(id: "tmod:@turbot/gcp-orgpolicy#/control/types/iamAutomaticIamGrantsForDefaultServiceAccounts") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-orgpolicy#/control/types/iamAutomaticIamGrantsForDefaultServiceAccounts'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-orgpolicy#/control/types/iamAutomaticIamGrantsForDefaultServiceAccounts"