iam_service_accounts_only.yaml

# This constraint checks that all IAM policy members are in the
# "gserviceaccount.com" domain.
apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAllowedPolicyMemberDomainsConstraintV2
metadata:
  name: service_accounts_only
  annotations:
    description: Checks that members that have been granted IAM roles belong to allowlisted
      domains.
spec:
  severity: high
  match:
    ancestries:
    - "organizations/**"
  parameters:
    domains:
    - gserviceaccount.com