gcloud-org-service-account-creation: Service Account Creation Not Disabled

id: gcloud-org-service-account-creation

info:
  name: Service Account Creation Not Disabled
  author: princechaddha
  severity: medium
  description: |
    Ensure that the creation of Cloud IAM service accounts is prevented within your Google Cloud organization through the "Disable Service Account Creation" organization policy. This allows you to easily centralize the management of your service accounts while not restricting the other permissions that your developers and administrators have on the projects within the organization.
  impact: |
    By default, service accounts can be created by users based on their IAM roles and permissions. If compromised, these service accounts could be used without your knowledge to access Google Cloud resources.
  remediation: |
    Enable the "Disable Service Account Creation" policy at the organization level using the 'gcloud alpha resource-manager org-policies enable-enforce' command with the iam.disableServiceAccountCreation constraint.
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ResourceManager/prevent-service-account-creation.html
    - https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
  tags: cloud,devops,gcp,gcloud,resourcemanager,security,iam,service-account,gcp-cloud-config

flow: |
  code(1)
  for(let orgId of iterate(template.orgIds)){
    set("orgId", orgId)
    code(2)
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud organizations list --format="json(name)"

    extractors:
      - type: json
        name: orgIds
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud alpha resource-manager org-policies describe iam.disableServiceAccountCreation --organization=$orgId --effective --format="json(booleanPolicy)"

    matchers:
      - type: word
        words:
          - "{}"

    extractors:
      - type: dsl
        dsl:
          - '"Organization " + orgId + " has not disabled service account creation, allowing users to create new service accounts"'
# digest: 4b0a00483046022100e04e0b4ab91889dc9566bf9458b19e335e54fc91446ea631b3ac2826ecd8f386022100c9c1a77a4f3b3f693496ed343c48a807ca2cd4c8253ba7bfdf16cf77e90197df:922c64590222798bb761d5b6d8e72950