Question

A financial services company has adopted keyless authentication across its Google Cloud organization. During a security review, the compliance team discovers that several development teams are still manually creating and downloading service account key files (JSON keys) and storing them in code repositories. Leadership mandates a preventive control that blocks the creation of user-managed service account keys across all projects, while allowing a narrow exception for one legacy integration project. What should the architect implement?

Accepted Answer

Apply the organization policy constraint 'iam.disableServiceAccountKeyCreation' at the organization node with enforcement enabled, then set an exception (allow) on the specific legacy project's folder or project node.

Answer

Create an IAM deny policy at the organization level that denies the 'iam.serviceAccounts.getAccessToken' permission for all principals except the legacy project's service accounts.

Answer

Grant the 'roles/iam.serviceAccountKeyAdmin' role only to a central security team and rely on periodic Cloud Audit Log reviews to detect and remove unauthorized keys.

Answer

Enable VPC Service Controls around all projects and add the legacy project to a separate service perimeter to isolate key creation activity.