Check ID: iam_sa_user_managed_key_rotate_90_days
Provider: GCP
Service: iam
Severity: LOW
Categories: secrets
Resource type: iam.googleapis.com/ServiceAccountKey

​
What this check verifies

GCP IAM service account user-managed keys are evaluated by last rotation. Keys of type USER_MANAGED older than 90 days are identified; those rotated within 90 days align with the expected rotation cadence.

​
Risk

Stale service account keys extend exposure of long-lived credentials. A leaked or retained key can grant persistent API access, enabling data exfiltration, tampering, and lateral movement. Weak rotation reduces revocation effectiveness and erodes confidentiality and integrity.

​
Recommendation

Rotate user-managed keys at least every 90 days and prefer Workload Identity Federation or other short-lived credentials over static keys.
  • Minimize key count; remove unused keys
  • Enforce least privilege on service accounts
  • Automate rotation and alert on aged keys
  • Set key expiry as defense in depth

​
Remediation

gcloud iam service-accounts keys delete <KEY_ID> --iam-account=<SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_sa_user_managed_key_rotate_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks