Google Cloud Compliance ControlsGoogle Cloud IAM
Service accounts should use only GCP-managed service account keys
IAM service accounts do not have keys of type `USER_MANAGED`. Only Google-managed keys (or no keys) are present. User managed service accounts should not have user-managed keys.
What this control checks
Service accounts have no USER_MANAGED keys
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.5.1: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
3 more clauses
- 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- A.5.15 Access control
- A.8.2 Privileged access rights
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 11 Access control
NIST Cybersecurity Framework v2.0
- GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.SC-02
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.AM-02
3 more clauses
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
- 1.4 Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
- 1.4 Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
1 more clause
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
- 1.4 Ensure that there are only GCP-managed service account keys for each service account
- 1.4 Ensure that there are only GCP-managed service account keys for each service account
- 1.4 Ensure that there are only GCP-managed service account keys for each service account
- 164.308(a)(3)(i) Workforce security
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_service_account_gcp_managed_key - Powerpipe Control:
gcp_compliance.control.iam_service_account_gcp_managed_key - Prowler Check:
iam_sa_no_user_managed_keys
Last reviewed: 2026-10-09