Check ID: iam_sa_user_managed_key_unused
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: secrets
Resource type: iam.googleapis.com/ServiceAccountKey

​
What this check verifies

User-managed service account keys with no recorded activity during the last max_unused_account_days are identified using key-usage metrics per service account.

​
Risk

Stale user-managed keys expand exposure of long-lived credentials. If leaked, an attacker can authenticate as the service account off-platform, bypass network controls, access data, alter resources, and persist-compromising confidentiality and integrity, and risking availability via destructive changes.

​
Recommendation

Prefer managed workload identities and service account impersonation over user-managed keys. Enforce iam.disableServiceAccountKeyCreation, remove unused keys, and use short key lifetimes with rotation when unavoidable. Apply least privilege, monitor key usage, and enforce separation of duties to limit blast radius.

​
Remediation

gcloud iam service-accounts keys delete <KEY_ID> --iam-account=<SERVICE_ACCOUNT_EMAIL>

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_sa_user_managed_key_unused. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks