IAM misconfigurations

Policy with users that don’t belong to the corporate domains

Risk Level

Informational (4)

Platform(s)
Compliance Frameworks

Description

Fully-managed corporate Google accounts can be used for increased visibility, auditing, and controlling access to Cloud Platform resources. Email accounts based outside of the user's organization, such as personal accounts, should not be used for business purposes. It was detected that the IAM policy '{GcpIamPolicy}' contains users with non corporate emails: {GcpIamPolicy.PolicyBindings.Users}.