From Console:

Go to 'IAM & admin/IAM' using 'https://console.cloud.google.com/iam-admin/iam'
Go to the 'Members'
Identify 'User-Managed user created' service account with roles containing '*Admin' or '*admin' or role matching 'Editor' or role matching 'Owner'
Click the 'Delete bin' icon to remove the role from the member (service account in this case)

From Command Line:

gcloud projects get-iam-policy PROJECT_ID --format json > iam.json

Using a text editor, Remove 'Role' which contains 'roles/*Admin' or 'roles/*admin' or matched 'roles/editor' or matches 'roles/owner'. Add a role to the bindings array that defines the group members and the role for those members.

For example, to grant the role roles/appengine.appViewer to the 'ServiceAccount' which is roles/editor, you would change the example shown below as follows:

{
"bindings": [
{
"members": [
"serviceAccount:our-project-123@appspot.gserviceaccount.com",
],
"role": "roles/appengine.appViewer"
},
{
"members": [
"user:email1@gmail.com"
],
"role": "roles/owner"
},
{
"members": [
"serviceAccount:our-project-123@appspot.gserviceaccount.com",
"serviceAccount:123456789012-compute@developer.gserviceaccount.com"
],
"role": "roles/editor"
}
],
"etag": "BwUjMhCsNvY="
}
2. Update the project's IAM policy:

gcloud projects set-iam-policy PROJECT_ID iam.json

ID	Name	CSP	Domain	Severity
AC_GCP_0239	Ensure That Service Account Has No Admin Privileges - google_storage_bucket_iam_member	GCP	Identity and Access Management	HIGH
AC_GCP_0238	Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible - google_storage_bucket_iam_member	GCP	Identity and Access Management	HIGH

Detections

Analytics

Tenable Cloud Security Policies Search

HIGH

HIGH