turbot/gcp_compliance

Query: compute_instance_with_no_default_service_account

Usage

powerpipe query gcp_compliance.query.compute_instance_with_no_default_service_account

Steampipe Tables

SQL

select
self_link resource,
case
when name like 'gke-%' and labels ? 'goog-gke-node' then 'skip'
when account ->> 'email' like '%-compute@developer.gserviceaccount.com' then 'alarm'
else 'ok'
end as status,
case
when name like 'gke-%' and labels ? 'goog-gke-node'
then title || ' created by GKE.'
when account ->> 'email' like '%-compute@developer.gserviceaccount.com'
then title || ' configured to use default service account.'
else title || ' not configured with default service account.'
end as reason
, location as location, project as project
from
gcp_compute_instance,
jsonb_array_elements(service_accounts) account;

Controls

The query is being used by the following controls: