Question

A financial services company is tightening its security posture across its Google Cloud organization. During an audit, the security team discovers that developers in multiple projects have been creating user-managed service account keys, which are rarely rotated and pose a credential-leak risk. Leadership mandates that no new service account keys can be created anywhere in the organization, while still allowing a single legacy project (used by an on-premises batch system) to continue creating keys until it is migrated. What is the most effective way to enforce this?

Accepted Answer

Apply the 'iam.disableServiceAccountKeyCreation' organization policy constraint at the organization node, and set an override policy that is not enforced on the legacy project's folder or project.

Answer

Remove the 'iam.serviceAccountKeyAdmin' role from all users at the organization level and grant it back only in the legacy project.

Answer

Create a Cloud Function triggered by audit logs that deletes any newly created service account key except in the legacy project.

Answer

Enable the 'constraints/iam.allowedPolicyMemberDomains' constraint at the organization level and exclude the legacy project.