GCP + Terraform : Service account access is granted to a user at project level

Question

I have an issue when trying to execute this terraform file on GCP.

Results #1-2 MEDIUM Service account access is granted to a user at project level. (2 similar results)
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
iam.tf Line 18
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   9  │ resource "google_project_iam_member" "permissions" {
  10  │   for_each = toset([
  11  │     "logging.logWriter",
  12  │     "errorreporting.writer",
  13  │     "iam.serviceAccountUser",
  14  │     "iam.serviceAccountTokenCreator",
  15  │     "workflows.invoker"
  16  │   ])
  17  │   provider = google-beta
  18  │   role     = "roles/${each.key}"
  19  │   member   = "serviceAccount:${google_service_account.default.email}"
  20  │ }
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Individual Causes
 - /Users/oussamafathallah/git/btdp/modules/00-oauth2-relay/iac/iam.tf:9-20 (google_project_iam_member.permissions)
 - /Users/oussamafathallah/git/btdp/modules/00-oauth2-relay/iac/iam.tf:9-20 (google_project_iam_member.permissions)
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
         ID google-iam-no-project-level-service-account-impersonation
     Impact Privilege escalation, impersonation of any/all services
 Resolution Provide access at the service-level instead of project-level, if required

 More Information
 - https://aquasecurity.github.io/tfsec/v1.0.2/checks/google/iam/no-project-level-service-account-impersonation/
 - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam

Can you help me on this issue please. I'm new to gcp and terraform. Thank you !

Answer 1

Granting this role "iam.serviceAccountTokenCreator" causes the warning.

That role allows users to use a service account for Privilege Escalation

Protecting against privilege-escalation threats