False Positive in iam_sa_no_administrative_privileges Check

[JOSHUAJEBARAJ]

Steps to Reproduce

Hey folks, when I run a Prowler scan on the IAM service in GCP, one of the checks, iam_sa_no_administrative_privileges, produces a false positive.

Steps to Reproduce

• Create a service account in the project, or use an existing service account.
• Assign theAccess Approval Config Editor role to the service account in the project. Run a scan using the command below:

  prowler gcp --project-ids <project-id> -b --services iam

• Open the result. You will find that the service account is shown as having admin privileges, even though it doesn't.

Expected behavior

According to the CIS benchmark, for the admin role, we should check if the word is present. For the owner and editor roles, we should look for an exact match. For example only roles/Editor should be considered as the admin role not the Access Approval Config Editor role

Actual Result with Screenshots or Logs

Service account with role that has name editor or owner has marked as the admin privileges

How did you install Prowler?

From pip package (pip install prowler)

Environment Resource

Running Locally

OS used

Ubuntu 22.04.4 LTS

Prowler version

Prowler 4.2.1

Pip version

pip 20.3.4

Context

No response

[jfagoagas]

Hello @JOSHUAJEBARAJ, we will review the issue you mention and get back to you soon.

Thanks for using Prowler 🚀

[JOSHUAJEBARAJ]

Hey folks, just wanted to let you know that I am happy to work on the patch if this issue is valid.

[sergargar]

Sure @JOSHUAJEBARAJ , that would be awesome! Let us know if you need anything from our side 😄