`sa_security_audit` — version 1.1

Source: presets/security-audit/sa-security-audit.satz

Purpose

A read-only security-audit service account, with the group that may impersonate it.

The pack combines several resource types (service account, group, organization IAM), so — like the audit log sink — it goes at the top level of the estate rather than under a single resource key.

After the apply, a human (not the tooling, which stays read-only) uses it: prowler gcp --impersonate-service-account $SA --compliance cis_5.0_gcp ... gcloud --impersonate-service-account=$SA gcloud auth application-default login --impersonate-service-account=$SA The last one produces the impersonated ADC the Prowler CLI and the SCC configuration read.

What this pack does NOT do:

no API enablement in the seed project (impersonation needs iamcredentials.googleapis.com — enable it separately)
no service-account keys: access is by token-creator impersonation only
no remediation rights: every role in the set is read-only

Use it

params {
  // the pack's own defaults — copy only the lines you change
  security_audit_sa_project = ""
  security_audit_sa_name = "sa-security-audit"
  security_audit_sa_display_name = "Security Audit (read-only)"
  security_audit_auditors_group = "grp-security-auditors"
}

use "presets/security-audit/sa-security-audit.satz"

Needs from outside the pack:

customer_domain — declared by estate_core; use one of them alongside, or declare it in the estate.
first_admin — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

param	default
`security_audit_sa_project`	`""`
`security_audit_sa_name`	`"sa-security-audit"`
`security_audit_sa_display_name`	`"Security Audit (read-only)"`
`security_audit_auditors_group`	`"grp-security-auditors"`

Questions

What to ask before this pack is configured, and what changing the answer costs.

asks about	prompt	reversal	blast	recommends
`security_audit_sa_project`	The project that hosts the security-audit service account	recreate	low	—
`security_audit_sa_name`	The service account's id (the part before @)	recreate	low	—
`security_audit_auditors_group`	The group whose members may impersonate the audit account (the local part)	recreate	low	—

security_audit_sa_project — There is no default: customers name projects their own way, and the account's address is derived from the project. Moving it later is a new account and every auditor re-onboarded to it.

security_audit_sa_name — The account's address is its identity: renaming it is a new account, new grants, and every auditor's impersonation re-pointed.

security_audit_auditors_group — Membership of this group is what makes someone an auditor. Renaming it is a new group with every member moved by hand.

Contributes

resource type	labels
`google_cloud_identity_group`	`{security_audit_auditors_group}`
`google_organization_iam_member`	`serviceAccount:{security_audit_sa_name}@{security_audit_sa_project}.iam.gserviceaccount.com (grant map)`, `group:{security_audit_auditors_group}@{customer_domain} (grant map)`
`google_service_account`	`security_audit`

Claims

None — this pack proves no control by itself.

History

version	date	change
1.1	2026-09-10	three `question` blocks — the hosting project (no default, blocks), the account id, the auditors group; each a recreate. The display name is not asked. Nothing emitted changes
1.0	2026-08-21	read-only security-audit service account with its custom role

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

Impersonation needs iamcredentials.googleapis.com enabled in the seed project, and this pack does not enable it — do that separately, or every impersonated call fails with a permission error that names the API.

The auditors group gets TokenCreator on the account rather than the roles themselves: one identity to audit with, and a group whose membership is a human decision.

sa_security_audit — version 1.1