Detections
Analytics

1.1.2 Ensure Super Admin Account Is Not Used For Google Cloud Administration

Information

It is recommended that super admin accounts are not granted any IAM roles in Google Cloud Platform and are used exclusively for identity management in Google Workspace or Cloud Identity. Google Cloud administration should be performed using separate regular user accounts that are granted appropriate GCP IAM roles.

The Super Admin role exists in Google Workspace/Cloud Identity to manage identities (users, groups, domains). Google Cloud resource management (VMs, networks, databases, IAM policies) should be handled by separate regular user accounts in Workspace/Cloud Identity that are granted GCP-specific IAM roles such as Organization Administrator. These are two separate privilege domains that should not be combined in a single account.

Separating super admin accounts from GCP administration is critical because Super Admin privileges are irrevocable and can override almost any setting in both Workspace and GCP. If a super admin account is granted GCP permissions and compromised through phishing, an attacker gains full control over both the email domain and the entire cloud infrastructure. Identity management (super admin) and cloud resource management (GCP IAM roles) are distinct operational domains requiring different access patterns and security controls. Super admin accounts not granted GCP IAM permissions cannot be used to directly manipulate cloud resources even if compromised, limiting blast radius to identity management functions only. GCP administrators should use regular Workspace user accounts with only the specific GCP IAM roles needed for their cloud responsibilities, not super admin privileges which extend to email, calendar, and identity systems. This separation enforces least privilege and reduces the attack surface by ensuring the most powerful account type (super admin) is isolated from daily cloud operations.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From Google Cloud Admin Console

 -

Create Separate Regular User Account for GCP Administration

 - Navigate to Google Admin console at https://admin.google.com
 - Go to Directory -> Users
 - Click Add new user
 - Create a regular user account (not a super admin) for GCP administration
 - Click Add new user
 - Configure additional security settings like enforcing 2-Step Verification
 - Important: Do NOT assign this user the Super Admin role in Workspace/Cloud Identity

 -

Grant GCP IAM Roles to the Cloud Admin User Account

 - Navigate to Google Cloud Console at https://console.cloud.google.com
 - Go to IAM & Admin -> IAM
 - Select your organization from the organization dropdown at the top
 - Click Grant Access
 - In the Add principals field, enter the regular user account created in Step 1
 - In the Select a role dropdown, assign appropriate GCP IAM roles. Example - Organization Administrator for organization-level administration. Add other roles as needed based on responsibilities
 - Click Save

 -

Delete All GCP IAM Bindings for Super Admin Users

 - Navigate to Google Cloud Console at https://console.cloud.google.com
 - Go to IAM & Admin -> IAM at the organization level
 - Identify all super admin user accounts in the IAM permissions list
 - For each super admin account:

 - Click the pencil icon (Edit principal) next to the account
 - Remove all assigned roles by clicking the trash icon next to each role
 - Click Save

 - Repeat for all folders and projects:

 - Navigate to each folder's and project's IAM & Admin -> IAM page
 - Remove super admin accounts from all IAM bindings

Impact:

Organizations must create separate regular user accounts in Workspace/Cloud Identity for GCP administration. These accounts will be granted appropriate GCP IAM roles (e.g., Organization Administrator) for cloud resource management. Existing super admin accounts that have been granted GCP IAM roles must have those permissions removed. Super admin accounts remain reserved for identity management tasks only.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5)

Plugin: GCP

Control ID: 9eafef9ad0a7eb484f228a8eae367e9cb480ade3ea6d257f51f056348fd8f9e6