Google Cloud Compliance ControlsGoogle Cloud IAM
Service account keys should limit age to 100 days
Prowler check iam_sa_user_managed_key_rotate_90_days evaluates GCP IAM service account user-managed keys by last rotation. Keys of type `USER_MANAGED` older than 90 days are identified. Keys rotated within 90 days align with the expected rotation cadence.
What this control checks
Identifies USER_MANAGED service account keys older than 90 days
Framework mappings
The clauses this control is mapped to in each framework.
- 8.3.5: Strong authentication for users and administrators is established and managed.
- 8.3.7: Strong authentication for users and administrators is established and managed.
- 8.3.9: Strong authentication for users and administrators is established and managed.
- 8.3.10.1: Strong authentication for users and administrators is established and managed.
- 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- A.5.16 Identity management
- 9 Cryptography
- 11 Access control
- 12 Asset management
NIST Cybersecurity Framework v2.0
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-05
- 1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
- 1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
3 more clauses
- DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and...
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- 1.7 Ensure user-managed/external keys for service accounts are rotated every 90 days or less
Related controls
- Service accounts should be used within the configured maximum unused period
- Cloud KMS encryption keys should have rotation configured within 90 days
- Compute Engine instances should not use the default service account
- GKE clusters should not use the default service account for project access
- IAM users should not have Service Account User or Service Account Token Creator roles at project level
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_restrict_service_account_key_age_one_hundred_days - Powerpipe Control:
gcp_compliance.control.iam_restrict_service_account_key_age_one_hundred_days - Prowler Check:
iam_sa_user_managed_key_rotate_90_days
Last reviewed: 2026-10-09