apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAllowedBindingsConstraintV1
metadata:
  name: blacklist_serviceaccount_user
  annotations:
    description: Ban any users from being granted Service Account User access
    benchmark: CIS11_1.05
spec:
  severity: high
  match:
    target: ["organization/*"]
    exclude: [] # optional, default is no exclusions
  parameters:
    mode: blacklist
    role: roles/iam.serviceAccountUser
    members:
    - "*"

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAllowedBindingsConstraintV1
metadata:
  name: blacklist_serviceaccount_user
  annotations:
    description: Ban any users from being granted Service Account User access
    # This constraint is not certified by CIS.
    bundles.validator.forsetisecurity.org/cis-v1.1: 1.05
spec:
  severity: high
  match:
    target: ["organization/*"]
    exclude: [] # optional, default is no exclusions
  parameters:
    mode: blacklist
    role: roles/iam.serviceAccountUser
    members:
    - "*"

Add bundle annotation for CIS benchmark (sample)
Add bundle annotation for CIS benchmark (sample)