GCP Service Account Key Auditor

A service account key JSON file contains credentials for authenticating as a GCP service account. It includes private key material, the service account email, and project information. These files grant persistent access to GCP APIs and must be treated as secrets — never commit them to version control.

Service account key JSON files don't expire by default (they're valid until rotated or deleted) and can be exfiltrated silently. Google recommends using Workload Identity Federation or short-lived tokens (via gcloud auth) instead of key files in production. Key files should only be used when other authentication methods are unavailable.

Assign only the roles a service account needs for its specific job. Instead of project-level Owner/Editor, use granular roles like roles/storage.objectViewer or custom roles. Audit service accounts regularly to remove unused roles. Use per-service accounts rather than one shared account for multiple workloads.

In GCP Console: IAM > Service Accounts > select account > Keys tab > Add Key. Download the new key, update your applications to use it, then delete the old key. Alternatively, use Workload Identity Federation to eliminate key files entirely for GKE, Cloud Run, and other GCP compute services.

Workload Identity Federation lets external identities (GitHub Actions, AWS IAM, Azure AD) authenticate to GCP without service account key files. You map external credentials to a service account using impersonation. This eliminates long-lived key files and is the recommended approach for CI/CD pipelines and cross-cloud workloads.