Check ID: iam_service_account_unused
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: iam.googleapis.com/ServiceAccount

​
What this check verifies

Google Cloud service accounts are evaluated for recent usage within a configurable window (default 180 days) using usage telemetry. It highlights which accounts show activity versus those with no observed use in that period.

​
Risk

Dormant but permissioned service accounts threaten confidentiality and integrity via:
  • Impersonation/privilege escalation through stale roles or leaked keys
  • Lateral movement and persistent access They also weaken accountability, obscuring audit trails when reactivated unnoticed.

​
Recommendation

Apply least privilege and reduce attack surface:
  • Verify inactivity, then disable and later delete unused accounts
  • Revoke role bindings and keys; favor short-lived impersonation over keys
  • Avoid powerful defaults; enforce separation of duties
  • Continuously monitor usage and alert on dormancy

​
Remediation

gcloud auth print-access-token --impersonate-service-account=<SERVICE_ACCOUNT_EMAIL>

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_service_account_unused. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks