Service accounts should be used within the configured maximum unused period
Google Cloud service accounts are evaluated for recent usage within a configurable window (default `180` days) using usage telemetry. It highlights which accounts show activity versus those with no observed use in that period.
Dormant but permissioned service accounts threaten confidentiality and integrity via impersonation/privilege escalation through stale roles or leaked keys. They also threaten confidentiality and integrity via lateral movement and persistent access. They also weaken accountability, obscuring audit trails when reactivated unnoticed.
What this control checks
Service accounts must have been used within the configured maximum unused period
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_service_account_unused (prowler gcp --checks iam_service_account_unused).
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 11.1.2.c (ensure that access is only granted to users that have been adequately authenticated.), 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...) and 7 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_iam_service_account_unused - Prowler Check:
iam_service_account_unused
Last reviewed: 2026-10-09