Google CloudOverview
Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests that you make to Google cloud services accessible to that particular Service account. It is recommended that all Service Account keys are regularly rotated.
Rationale
Rotating Service Account keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used. Service Account keys should be rotated to ensure that data cannot be accessed with an old key which might have been lost, cracked, or stolen.
Each service account is associated with a key pair, which is managed by Google Cloud Platform (GCP). It is used for service-to-service authentication within GCP. Google rotates the keys daily.
GCP provides option to create one or more user-managed (also called as external key pairs) key pairs for use from outside GCP (for example, for use with Application Default Credentials). When a new key pair is created, user is enforced download the private key (which is not retained by Google). With external keys, users are responsible for security of the private key and other management operations such as key rotation. External keys can be managed by the IAM API, gcloud command-line tool, or the Service Accounts page in the Google Cloud Platform Console. GCP facilitates up to 10 external service account keys per service account to facilitate key rotation.
Remediation guidance
From Console
Delete external (user managed) Service Account Key older than 90 days
- Go to
APIs & Services\Credentialsusing https://console.cloud.google.com/apis/credentials - In Section
Service Account Keys, for every external (user managed) Service account key withcreation dateis more than or equal to past 90 days clickDelete Bin IcontoDelete Service Account key
Create New external (user managed) Service Account Key for a Service Account
- Go to
APIs & Services\Credentialsusing https://console.cloud.google.com/apis/credentials - Click
Create CredentialsandSelect Service Account Key - Choose Service account in drop-down list for which External (user managed) Service Account key needs to be created
- Select desired key type format among
JSONorP12 - Click
Create. It will downloadprivate key. Keep it safe. - Click
Closeif prompted - It will redirect to
APIs & Services\Credentialspage. Make a note of NewIDdisplayed in sectionService account keys
Impact
Rotating service account key will break communication for depending applications. Dependent applications needs to configured manually with new key id displayed in section Service account keys and private key downloaded by user.
Default Value
GCP does not provides automation option for External (user managed) Service key rotation.
References:
- https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys
- https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/list
- https://cloud.google.com/iam/docs/service-accounts
Notes
For user-managed Service Account key(s), key management is entirely users responsibility.
Multiple Remediation Paths
Google Cloud
SERVICE-WIDE (RECOMMENDED when many resources are affected): Enforce Organization Policies at org/folder level so new resources inherit secure defaults.
gcloud org-policies set-policy policy.yaml
ASSET-LEVEL: Use the product-specific remediation steps above for only the impacted project/resources.
PREVENTIVE: Use org policy constraints/custom constraints and enforce checks in deployment pipelines.
References for Service-Wide Patterns
- GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
- GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies
Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
1. Contain at Service-Wide Scope First (Recommended)
- Google Cloud: apply organization policy constraints at org/folder scope.
gcloud org-policies set-policy policy.yaml
2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
User-managed/external keys for service accounts are rotated every 90 days or less
Connectors
Covered asset types
Expected check: eq []
GCPIAM5{...AssetFragment}
