Service accounts should use only GCP-managed service account keys
IAM service accounts do not have keys of type `USER_MANAGED`. Only Google-managed keys (or no keys) are present. User managed service accounts should not have user-managed keys.
User-managed keys are downloadable and long-lived, increasing theft and reuse risk. An attacker with a key can impersonate the service account, perform unauthorized API calls, exfiltrate data, and alter resources. Copies in repos or logs can evade centralized rotation and revocation.
What this control checks
Service accounts have no USER_MANAGED keys
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_sa_no_user_managed_keys (prowler gcp --checks iam_sa_no_user_managed_keys); PowerPipe control gcp_compliance.control.iam_service_account_gcp_managed_key.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.5.1 (Access to system components and data is appropriately defined and assigned.), 7.3.1 (Access to system components and data is managed via an access control system(s).) and 5 more clauses.
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control) and A.8.2 (Privileged Access Rights).
NIS2 Directive (EU 2022/2555): Mapped to 11.1.2.c (ensure that access is only granted to users that have been adequately authenticated.), 11.2.2.a (assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;), 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...) and 10 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to GV.RM-01 (Risk management objectives are established and agreed to by organizational stakeholders.), GV.RR-02 (Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated...), GV.SC-02 (Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and...) and 5 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.5.1: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
3 more clauses
- 8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- 8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- A.5.15 Access control
- A.8.2 Privileged access rights
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 11 Access control
NIST Cybersecurity Framework v2.0
- GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders.
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.SC-02
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.AM-02
3 more clauses
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
- 1.4 Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
- 1.4 Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
1 more clause
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
- 1.4 Ensure that there are only GCP-managed service account keys for each service account
- 1.4 Ensure that there are only GCP-managed service account keys for each service account
- 1.4 Ensure that there are only GCP-managed service account keys for each service account
- 164.308(a)(3)(i) Workforce security
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_service_account_gcp_managed_key - Powerpipe Control:
gcp_compliance.control.iam_service_account_gcp_managed_key - Prowler Check:
iam_sa_no_user_managed_keys
Last reviewed: 2026-10-09