Google Cloud Compliance ControlsGoogle Cloud IAM
User-managed or external service account keys should have rotation configured every 90 days or less
Checks that user-managed Service Account keys are rotated regularly. Service Account keys consist of a key ID (`Private_key_Id`) and a private key, and they are used to sign programmatic requests, so all keys should be rotated on a regular schedule.
What this control checks
User-managed service account keys must be rotated within the last 90 days
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.5.1: Access to system components and data is appropriately defined and assigned.
- 8.3.5: Strong authentication for users and administrators is established and managed.
- 8.3.7: Strong authentication for users and administrators is established and managed.
- 8.3.9: Strong authentication for users and administrators is established and managed.
- 8.3.10.1: Strong authentication for users and administrators is established and managed.
1 more clause
- 8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- A.5.16 Identity management
- 9 Cryptography
- 11 Access control
- 12 Asset management
NIST Cybersecurity Framework v2.0
- DE.CM-03
- GV.RM-01: Risk management objectives are established and agreed to by organizational stakeholders.
- GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained.
- GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
- GV.RM-04: Strategic direction that describes appropriate risk response options is established and communicated.
8 more clauses
- GV.RR-02: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
- GV.SC-02
- GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
- ID.AM-02
- ID.AM-08
- PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
- PR.AA-03
- PR.AA-05
- 1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
- 1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
- CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
3 more clauses
- DEV-12.02B Unless unavoidable, the cloud service provider does not reuse the cryptographic secret and private keys and other secrets used in production environments in other, non-production environments. Any unavoidable reuse of the cryptographic secret and private keys between production and...
- IAM-08.02B Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- 1.7 Ensure user-managed/external keys for service accounts are rotated every 90 days or less
- 1.7 Ensure user-managed/external keys for service accounts are rotated every 90 days or less
- 1.7 Ensure user-managed/external keys for service accounts are rotated every 90 days or less
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iam_service_account_key_age_90 - Powerpipe Control:
gcp_compliance.control.iam_service_account_key_age_90 - Prowler Check:
iam_sa_user_managed_key_rotate_90_days
Last reviewed: 2026-10-09