Check ID: iam_sa_no_user_managed_keys
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: secrets, identity-access
Resource type: iam.googleapis.com/ServiceAccount

​
What this check verifies

IAM service accounts do not have keys of type USER_MANAGED; only Google-managed keys (or no keys) are present.

​
Risk

User-managed keys are downloadable and long-lived, increasing theft and reuse risk. An attacker with a key can impersonate the service account, perform unauthorized API calls, exfiltrate data, and alter resources, impacting confidentiality and integrity, and potentially availability. Copies in repos or logs can evade centralized rotation and revocation.

​
Recommendation

Avoid user-managed keys. Use service account impersonation or Workload Identity Federation for short-lived credentials and least privilege. Enforce iam.disableServiceAccountKeyCreation, restrict who can create keys, and monitor usage. If exceptions are unavoidable, tightly scope, rotate aggressively, and store keys securely.

​
Remediation

gcloud iam service-accounts keys delete <KEY_ID> --iam-account=<SERVICE_ACCOUNT_EMAIL>

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_sa_no_user_managed_keys. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks