ServiceNow CMDB CI relationship sync: faster, more complete →
Turbot Guardrails Hub 
Hub
Mods
GCP
36
Mods
142
Resource Types
2,068
Policies
939
Controls
118
Quick Actions
85
IAM

Policy: GCP > Project > Organization Policy > Disable Automatic IAM Grants for Default Service Accounts

Manage the GCP Organization Policy "Disable Automatic IAM Grants for Default Service Accounts" for the project.

This boolean constraint, when enforced, prevents the default App Engine and Compute Engine service accounts that are created in your projects from being automatically granted any IAM role on the project when the accounts are created.

By default, these service accounts automatically receive the Editor role when they are created.

Resource Types

This policy targets the following resource types:

Primary Policy

This policy is used with the following primary policy:

Controls

Policy Specification

Schema Type
string
Default
Skip
Valid Values [YAML]
  • Skip

  • Check: Inherited

  • Check: Google-managed default

  • Check: On, effective value

  • Check: Off, effective value

  • Check: On, inherited

  • Check: Off, inherited

  • Check: On, set on project

  • Check: Off, set on project
Examples [YAML]
  • Skip

Category

In Your Workspace

Developers