Policy: GCP > Project > Organization Policy > Disable Automatic IAM Grants for Default Service Accounts

Manage the GCP Organization Policy "Disable Automatic IAM Grants for Default Service Accounts" for the project.

This boolean constraint, when enforced, prevents the default App Engine and Compute Engine service accounts that are created in your projects from being automatically granted any IAM role on the project when the accounts are created.

By default, these service accounts automatically receive the Editor role when they are created.

Targets

This policy targets the following resource types:

GCP > Project

Primary Policy

This policy is used with the following primary policy:

GCP > Project > Organization Policy

Policy Specification

Schema Type	`string`
Default	`Skip`
Valid Values [YAML]	`Skip` `Check: Inherited` `Check: Google-managed default` `Check: On, effective value` `Check: Off, effective value` `Check: On, inherited` `Check: Off, inherited` `Check: On, set on project` `Check: Off, set on project`
Examples [YAML]	`Skip`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/policy

Policy Type URI

tmod:@turbot/gcp-orgpolicy#/policy/types/iamAutomaticIamGrantsForDefaultServiceAccounts

GraphQL

query policyType(id: "tmod:@turbot/gcp-orgpolicy#/policy/types/iamAutomaticIamGrantsForDefaultServiceAccounts") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-orgpolicy#/policy/types/iamAutomaticIamGrantsForDefaultServiceAccounts'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-orgpolicy#/policy/types/iamAutomaticIamGrantsForDefaultServiceAccounts'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/gcp-orgpolicy#/policy/types/iamAutomaticIamGrantsForDefaultServiceAccounts"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-orgpolicy#/policy/types/iamAutomaticIamGrantsForDefaultServiceAccounts"