Question

Your platform team manages a Google Cloud organization with hundreds of service accounts created over several years. Security has raised concerns that many service accounts may be unused or over-privileged, creating attack surface. You need a repeatable, low-effort approach to identify service accounts that have not authenticated recently and detect roles granted but never used, so you can safely disable or right-size them. Which approach should you implement?

Accepted Answer

Enable IAM Service Account usage insights and IAM Recommender (role recommendations), then review activity metrics and lateral-movement/least-privilege findings in Active Assist before disabling or trimming permissions.

Answer

Write a scheduled Cloud Function that parses Cloud Billing exports to infer which service accounts consumed resources and delete any that have no associated cost.

Answer

Rotate all service account keys monthly and assume any account whose key rotation fails is unused, then delete those accounts.

Answer

Grant every service account the Viewer role at the organization level so their access is uniform, then manually audit the audit logs each quarter.