Question

A developer accidentally committed a service-account key (JSON) to a public GitHub repository. Your security team wants to immediately stop the key from being used to authenticate while preserving the service account itself and its other keys for ongoing production workloads. What should you do first?

Accepted Answer

Delete the compromised service-account key using gcloud iam service-accounts keys delete.

Answer

Delete the entire service account so no key can be used, then recreate it later.

Answer

Remove all IAM role bindings from the service account at the project level.

Answer

Rotate the project's organization policy to block service-account key creation.