1. Open the Google Cloud Console and select the organization for which you want to remediate the misconfiguration.
2. Click on the “IAM & Admin” option from the left-hand menu.
3. From the IAM dashboard, click on the “Roles” tab.
4. Search for the “Service Account Admin” role and click on it.
5. Click on the “Edit” button to edit the role.
6. In the “Permissions” tab, search for the “iam.serviceAccounts.create” permission and remove it from the role.
7. Click on the “Save” button to save the changes.
8. Repeat the above steps for the “Service Account User” role.

​

1. First, you need to enable the “Constraint API” in your GCP project. You can do this by going to the “APIs & Services” section in the Cloud Console and searching for “Constraint API”. Once you find it, enable it.
2. Next, you need to create a new constraint that prevents Service Account creation. You can do this using the following Python code:

from google.cloud import resource_manager_v3 as rm

# Replace ORGANIZATION_ID with your GCP organization ID
ORGANIZATION_ID = "YOUR_ORGANIZATION_ID"

# Create the Constraint object
constraint = {
    "constraint_default": True,
    "display_name": "Prevent Service Account Creation",
    "description": "Prevents the creation of Service Accounts in the organization",
    "constraint_type": "constraints/compute.disableServiceAccountCreation",
    "list_constraint": {
        "supports_in": True,
        "constraint_values": []
    },
    "version": 0
}

# Create the Constraint using the Resource Manager API
client = rm.OrganizationsClient()
response = client.create_constraint(parent=f"organizations/{ORGANIZATION_ID}", constraint=constraint)

print(response)

3. This code creates a new constraint that prevents Service Account creation in your GCP organization. You can verify that the constraint has been created by going to the “Constraints” section in the Cloud Console.
4. Once the constraint is in place, any attempt to create a Service Account in your GCP organization will fail.