GCP Service Account Key Checker

A service account key is a JSON file containing credentials that allow applications to authenticate to Google Cloud APIs as a service account. The key file contains a private RSA key, the service account email, project ID, and OAuth endpoints. Applications use the key with client libraries or gcloud CLI to obtain access tokens. Keys are powerful — they grant the permissions of the service account and don't expire by default.

Service account key files are long-lived credentials that are easy to leak (committed to Git, stored in environment variables, included in container images). Google recommends avoiding key files when running on GCP infrastructure. Alternatives: Workload Identity Federation for GKE workloads (Pod uses its Kubernetes service account to authenticate without a key), Application Default Credentials on Compute Engine/Cloud Run (no key needed — ADC uses the VM's attached service account), and Workload Identity Federation for external workloads (GitHub Actions, AWS, Azure).

Create a new key before disabling the old one to avoid downtime. Steps: 1) Create a new key (gcloud iam service-accounts keys create), 2) Update all systems using the old key to use the new one, 3) Verify the new key works, 4) Delete the old key (gcloud iam service-accounts keys delete). GCP recommends rotating keys every 90 days. You can list all keys with 'gcloud iam service-accounts keys list --iam-account=SA_EMAIL'.

service_account keys represent non-human identities designed for application authentication. They have long-lived RSA private keys and grant the permissions of the service account's IAM bindings. authorized_user keys represent OAuth2 credentials for a human Google account (generated by gcloud auth application-default login). These are user-context credentials with user-level permissions. Never use authorized_user credentials in production — use service accounts with minimal permissions instead.

Workload Identity Federation lets external workloads (GitHub Actions, AWS EC2, Azure VMs, Kubernetes outside GCP) authenticate to GCP without service account key files. Instead of a long-lived key, the workload exchanges a short-lived credential from its native platform for a GCP access token. This eliminates the key rotation problem and reduces the risk of credential leaks. For GKE specifically, Workload Identity maps Kubernetes service accounts to GCP service accounts.

Use 'gcloud projects get-iam-policy PROJECT_ID --flatten=bindings[].members --filter=bindings.members:serviceAccount:SA_EMAIL --format=table(bindings.role)' to list all roles bound to a service account at the project level. Also check at the folder and organization level. Use IAM Recommender to identify unused permissions for least-privilege cleanup. The Google Cloud Console IAM page also shows effective permissions with inherited roles.