Google Cloud Compliance ControlsGoogle Cloud IAM
User-managed service account keys should be used within the allowed inactivity period
User-managed service account keys with no recorded activity during the last `max_unused_account_days` are identified using key-usage metrics per service account. Prowler check iam_sa_user_managed_key_unused reports such stale keys.
What this control checks
Checks user-managed service account keys for inactivity
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 11 Access control
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
- 164.308(a)(3)(i) Workforce security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_iam_sa_user_managed_key_unused - Prowler Check:
iam_sa_user_managed_key_unused
Last reviewed: 2026-10-09