Service Account Keys Should Be Rotated

Using Console

To remediate the misconfiguration “Service Account Keys Should Be Rotated” for GCP using GCP console, follow the steps below:

Login to the Google Cloud Console using your credentials.
Navigate to the IAM & Admin page from the left-hand menu.
Click on Service Accounts from the list of options.
Select the service account for which you want to rotate the keys.
Click on the Edit button for the selected service account.
Scroll down to the Keys section and click on the Add Key button.
Select the type of key you want to add from the dropdown list.
Click on the Create button to generate the new key.
Once the new key is created, download it and store it securely.
Delete the old key(s) that are no longer required.

By following these steps, you have successfully rotated the service account keys for your GCP project. Make sure to repeat this process periodically to keep your service account keys up to date.

Using CLI

To remediate the misconfiguration “Service Account Keys Should Be Rotated” for GCP using GCP CLI, you can follow the below steps:

First, you need to identify the Service Account Keys that need to be rotated. You can use the below command to list all the Service Accounts in your project:

gcloud iam service-accounts list

Once you have identified the Service Account that needs to be rotated, you can create a new key for that Service Account using the below command:

gcloud iam service-accounts keys create [FILE_NAME].json --iam-account [SERVICE_ACCOUNT_EMAIL]

Replace [FILE_NAME] with the name of the file you want to create for the new key and replace [SERVICE_ACCOUNT_EMAIL] with the email of the Service Account that needs to be rotated.

After creating the new key, you need to delete the old key. You can use the below command to list all the keys for a Service Account:

gcloud iam service-accounts keys list --iam-account [SERVICE_ACCOUNT_EMAIL]

Once you have identified the old key that needs to be deleted, you can use the below command to delete it:

gcloud iam service-accounts keys delete [KEY_ID] --iam-account [SERVICE_ACCOUNT_EMAIL]

Replace [KEY_ID] with the ID of the key that needs to be deleted and replace [SERVICE_ACCOUNT_EMAIL] with the email of the Service Account.

Finally, you need to ensure that the new key is being used by all the applications that were using the old key. You can update the applications with the new key manually or by using automation tools like Ansible or Terraform.

By following the above steps, you can remediate the misconfiguration “Service Account Keys Should Be Rotated” for GCP using GCP CLI.

Using Python

To remediate the misconfiguration “Service Account Keys Should Be Rotated” in GCP using Python, you can follow the below steps:Step 1: Install the required librariesInstall the Google Cloud SDK and the Python client library using pip.

!pip install google-cloud-storage

Step 2: Authenticate the clientAuthenticate the client using the service account key that you want to rotate.

from google.oauth2 import service_account
from google.cloud import storage

key_path = 'path/to/service_account_key.json'
credentials = service_account.Credentials.from_service_account_file(key_path)
client = storage.Client(credentials=credentials)

Step 3: Rotate the service account keyCreate a new service account key and delete the old one.

from google.cloud import iam

iam_client = iam.IAMClient(credentials=credentials)

# Get the service account ID
service_account_email = 'service-account@project-id.iam.gserviceaccount.com'
service_account_id = service_account_email.split('@')[0]

# Create a new service account key
new_key = iam_client.create_service_account_key(name=f'projects/-/serviceAccounts/{service_account_email}')['privateKeyData']

# Delete the old service account key
keys = iam_client.list_service_account_keys(name=f'projects/-/serviceAccounts/{service_account_email}')
for key in keys:
    if key.key_id != 'latest':
        iam_client.delete_service_account_key(name=key.name)

Step 4: Save the new service account keySave the new service account key to a file.

import base64

new_key = base64.b64decode(new_key).decode('utf-8')
with open('path/to/new_service_account_key.json', 'w') as f:
    f.write(new_key)

Step 5: Update the service account key in the applicationUpdate the service account key in the application with the new key that you have generated.Note: Make sure to update the service account key in all the places where it is being used.By following these steps, you can remediate the misconfiguration “Service Account Keys Should Be Rotated” in GCP using Python.

Using Terraform

Terraform cannot rotate GCP service account keys based on age; the provider exposes key creation/deletion (google_service_account_key) but not “rotate after N days” behavior, so enforcing a 90‑day threshold is an external/process concern, not a declarative setting.You can manage keys with Terraform, but rotation must be driven by you (e.g., CI pipeline that periodically runs terraform apply with a forced replacement). A minimal pattern is:

resource "google_service_account" "example" {
  account_id   = "SERVICE_ACCOUNT_ID"         # e.g. "my-app-sa"
  display_name = "SERVICE_ACCOUNT_DISPLAY_NAME"
}

# One managed key for the service account
resource "google_service_account_key" "example_key" {
  service_account_id = google_service_account.example.name

  # Optionally keep the private key in state (default is true).
  # Be sure your state backend is secured if you do this.
  keepers = {
    # Bump this value (e.g., via CI variable) on your 90‑day schedule
    rotation_id = "ROTATION_ID_YYYYMMDD"      # e.g. "20261001"
  }
}

To rotate every ≤90 days:

Update rotation_id (or another keepers field) on your schedule.
terraform plan should show google_service_account_key.example_key as forces replacement.
terraform apply creates a new key and destroys the old one.

Because updating workloads to use the new key and validating that it works are runtime actions, they must be handled outside Terraform. Console/API alternative: create a new key on the service account, update consumers to use it, then delete the old key, repeating at least every 90 days.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Service Account Keys Should Be Rotated

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​