Question

A financial services company runs a compliance workflow on Compute Engine VMs. Auditors flag that the default Compute Engine service account is attached to every VM and holds the Editor role at the project level. The security team wants each application to run with only the specific permissions it needs, and they want to eliminate the risk associated with the broad default account without breaking existing workloads during migration. What is the recommended sequence of actions to achieve least privilege?

Accepted Answer

Disable automatic granting of the Editor role to the default service account at the organization level, create dedicated user-managed service accounts with narrowly scoped predefined roles for each application, attach them to the corresponding VMs, and then disable the default service account once workloads are verified.

Answer

Delete the default Compute Engine service account immediately, then grant the Owner role to a single new service account shared across all VMs so that every application continues to function.

Answer

Leave the default service account attached but add an IAM deny policy that blocks all Editor permissions, so the VMs keep running while permissions are effectively removed.

Answer

Create service account keys for each application, distribute the keys to the VMs as environment variables, and revoke the default service account's Editor role.