Google Cloud Compliance ControlsGoogle Cloud IAM
Service accounts should be used within the configured maximum unused period
Google Cloud service accounts are evaluated for recent usage within a configurable window (default `180` days) using usage telemetry. It highlights which accounts show activity versus those with no observed use in that period.
What this control checks
Service accounts must have been used within the configured maximum unused period
Framework mappings
The clauses this control is mapped to in each framework.
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_iam_service_account_unused - Prowler Check:
iam_service_account_unused
Last reviewed: 2026-10-09