iam_block_service_account_creator_role.yaml

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAllowedBindingsConstraintV3
metadata:
  name: block_serviceaccount_token_creator
  annotations:
    description: Ban any users from being granted Service Account Token Creator access
    # This constraint is not certified by CIS.
    bundles.validator.forsetisecurity.org/cis-v1.1: 1.0X  # TODO: Update this with final number when the CIS benchmark is finalized
spec:
  severity: high
  match:
    ancestries:
    - "organizations/**"
    excludedAncestries: [] # optional, default is no exclusions
  parameters:
    mode: denylist
    assetType: cloudresourcemanager.googleapis.com/Project
    role: roles/iam.serviceAccountTokenCreator
    members:
    - "*" # Although it is still okay to use "*" to match all, consider using "**" (see https://www.openpolicyagent.org/docs/latest/policy-reference/#glob)