Least privilege for Terraform service accounts - Mini Project: Build & Apply

Least privilege for Terraform service accounts

📖 Scenario: You are setting up a Terraform service account in a cloud environment. To keep your cloud secure, you want to give this service account only the permissions it absolutely needs. This is called the principle of least privilege.Imagine you have a janitor who only needs keys to the rooms they clean, not the whole building. Similarly, your Terraform service account should only have access to the resources it manages.

🎯 Goal: Build a Terraform configuration that creates a service account with the minimum required permissions to manage compute instances. You will define the service account, assign a role with limited permissions, and output the service account email.

📋 What You'll Learn

Create a Terraform resource for a service account named terraform_sa with the account ID terraform-service-account.

Create a Terraform resource to bind the role roles/compute.instanceAdmin.v1 to the service account.

Output the service account email as service_account_email.

💡 Why This Matters

🌍 Real World

Cloud engineers often create service accounts with minimal permissions to automate infrastructure deployment securely.

💼 Career

Understanding how to assign least privilege roles to service accounts is essential for cloud security and compliance roles.

1

Create the Terraform service account resource

Write a Terraform resource block named terraform_sa of type google_service_account. Set the account_id to terraform-service-account and the display_name to Terraform Service Account.

Terraform

# Your code here to create the google_service_account resource named terraform_sa

Hint

Use the google_service_account resource type and set the account_id and display_name exactly as specified.

2

Create the IAM binding for the service account

Add a Terraform resource named terraform_sa_binding of type google_project_iam_member. Set the role to roles/compute.instanceAdmin.v1. Set the member to the service account email using "serviceAccount:${google_service_account.terraform_sa.email}". Use a project ID variable var.project_id for the project attribute.

Terraform

resource "google_service_account" "terraform_sa" {
  account_id   = "terraform-service-account"
  display_name = "Terraform Service Account"
}

# Your code here to create the google_project_iam_member resource named terraform_sa_binding

Hint

Use the google_project_iam_member resource to assign the role to the service account. Reference the service account email with interpolation.

3

Declare the project ID variable

Declare a Terraform variable named project_id of type string with no default value. This variable will hold the Google Cloud project ID.

Terraform

resource "google_service_account" "terraform_sa" {
  account_id   = "terraform-service-account"
  display_name = "Terraform Service Account"
}

resource "google_project_iam_member" "terraform_sa_binding" {
  project = var.project_id
  role    = "roles/compute.instanceAdmin.v1"
  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
}

# Your code here to declare the project_id variable

Hint

Use the variable block to declare project_id as a string without a default.

4

Output the service account email

Add a Terraform output named service_account_email that outputs the email of the terraform_sa service account using google_service_account.terraform_sa.email.

Terraform

resource "google_service_account" "terraform_sa" {
  account_id   = "terraform-service-account"
  display_name = "Terraform Service Account"
}

resource "google_project_iam_member" "terraform_sa_binding" {
  project = var.project_id
  role    = "roles/compute.instanceAdmin.v1"
  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
}

variable "project_id" {
  type = string
}

# Your code here to output the service account email

Hint

Use the output block to expose the service account email.

Practice

1. What does the principle of least privilege mean for Terraform service accounts?

easy

A. Give only the permissions Terraform needs to do its job

B. Give Terraform full admin access to all cloud resources

C. Allow Terraform to access resources only during business hours

D. Share Terraform service account credentials with all team members

Solution

1. Step 1: Understand least privilege concept

   Least privilege means giving only the minimum permissions needed to perform a task.

2. Step 2: Apply to Terraform service accounts

   Terraform service accounts should have only the permissions required to manage infrastructure, nothing more.

3. Final Answer:

   Give only the permissions Terraform needs to do its job -> Option A

4. Quick Check:

   Least privilege = minimal needed permissions [OK]

Hint: Least privilege means minimal permissions only [OK]

Common Mistakes:

• Giving Terraform full admin rights unnecessarily
• Sharing credentials widely
• Setting time-based access without need

2. Which Terraform configuration snippet correctly assigns least privilege to a service account for managing only compute instances?

easy

A. resource "google_project_iam_member" "compute_admin" {
project = var.project_id
role = "roles/compute.admin"
member = "serviceAccount:${var.service_account_email}"
}

B. resource "google_project_iam_member" "storage_admin" {
project = var.project_id
role = "roles/storage.admin"
member = "serviceAccount:${var.service_account_email}"
}

C. resource "google_project_iam_member" "viewer" {
project = var.project_id
role = "roles/viewer"
member = "serviceAccount:${var.service_account_email}"
}

D. resource "google_project_iam_member" "editor" {
project = var.project_id
role = "roles/editor"
member = "serviceAccount:${var.service_account_email}"
}

Solution

1. Step 1: Identify the role for compute instance management

   The role "roles/compute.admin" allows managing compute instances specifically.

2. Step 2: Match the role to the service account in Terraform

   The snippet assigns "roles/compute.admin" to the service account, limiting permissions to compute resources only.

3. Final Answer:

   The snippet assigning roles/compute.admin to the service account -> Option A

4. Quick Check:

   Assign specific roles, not broad ones [OK]

Hint: Match role to exact resource type needed [OK]

Common Mistakes:

• Using broad roles like editor or admin unnecessarily
• Assigning unrelated roles like storage.admin
• Using viewer role which is read-only

3. Given this Terraform IAM binding snippet, what is the effective permission scope for the service account?

resource "google_project_iam_member" "sa_role" {
  project = "my-project"
  role    = "roles/storage.objectViewer"
  member  = "serviceAccount:[e-mail]"
}

medium

A. Full access to all storage buckets and objects

B. No access to storage resources

C. Write access to storage buckets

D. Read-only access to storage objects only

Solution

1. Step 1: Understand the role assigned

   The role "roles/storage.objectViewer" grants read-only access to storage objects.

2. Step 2: Determine permission scope

   This role does not allow writing or bucket management, only viewing objects.

3. Final Answer:

   Read-only access to storage objects only -> Option D

4. Quick Check:

   roles/storage.objectViewer = read-only object access [OK]

Hint: Check role name keywords: viewer means read-only [OK]

Common Mistakes:

• Confusing viewer with admin or editor roles
• Assuming bucket write permissions
• Thinking full storage access is granted

4. You wrote this Terraform code to assign a role to a service account but get an error:

resource "google_project_iam_member" "sa_role" {
  project = var.project_id
  role    = "roles/compute.viewer"
  member  = "serviceAccount:${var.service_account_email}"
  member  = "serviceAccount:[e-mail]"
}

What is the problem?

medium

A. Role 'roles/compute.viewer' does not exist

B. Duplicate 'member' keys cause a syntax error

C. Service account email format is invalid

D. Project ID variable is missing

Solution

1. Step 1: Check Terraform resource syntax

   Terraform resource blocks cannot have duplicate keys; 'member' is repeated twice here.

2. Step 2: Understand correct way to assign multiple members

   To assign multiple members, use 'google_project_iam_binding' or multiple resources, not duplicate keys.

3. Final Answer:

   Duplicate 'member' keys cause a syntax error -> Option B

4. Quick Check:

   Duplicate keys in resource block = syntax error [OK]

Hint: No duplicate keys in Terraform blocks [OK]

Common Mistakes:

• Using duplicate keys instead of lists or multiple resources
• Assuming role name is invalid without checking
• Ignoring variable definitions

5. You want to create a Terraform service account with least privilege to manage only network resources in a Google Cloud project. Which approach is best?

hard

A. Assign the role 'roles/owner' to the service account temporarily

B. Assign the role 'roles/editor' to the service account for all resources

C. Assign the role 'roles/compute.networkAdmin' to the service account only

D. Assign no roles and rely on default permissions

Solution

1. Step 1: Identify the role for network management

   The role 'roles/compute.networkAdmin' grants permissions to manage network resources only.

2. Step 2: Apply least privilege principle

   Assigning only this role limits the service account to network tasks, avoiding broad permissions.

3. Step 3: Avoid broad or no permissions

   Roles like 'editor' or 'owner' are too broad; no roles means no access.

4. Final Answer:

   Assign the role 'roles/compute.networkAdmin' to the service account only -> Option C

5. Quick Check:

   Least privilege = specific role only [OK]

Hint: Pick the narrowest role matching needed tasks [OK]

Common Mistakes:

• Using broad roles like editor or owner
• Not assigning any role and expecting access
• Assigning multiple unrelated roles