GCP Terraform Misconfiguration: Improper Compute Engine Access Control

A Terraform configuration grants a service account full access to most Google Cloud APIs.

The Terraform configuration sets the access scope of a service account to cloud-platform, which allows access to most of the Google Cloud APIs. This greatly expands the attack surface accessible to any compromised Compute Engine instance and violates the least privilege principle.

Example 1: The following example shows a Terraform configuration that sets the access scope (scopes) of the service account to cloud-platform.

resource "google_compute_instance" "compute-instance-demo" {
    name         = "name-demo"
    machine_type = "e2-micro"
    ...
    service_account {
        email  = "foobar.service.account@example.com"
        scopes = ["cloud-platform"]
    }
}