Direct answer
A service account key can grant the account's access to whoever possesses it. Prefer supported keyless alternatives where possible and maintain an owner, rotation and incident process for keys that remain necessary.
Inventory key ownership
List service accounts, key identifiers, creation dates, owners and consuming workloads across authorized projects. Record only metadata, never private key material. Identify unowned keys and applications that may be affected by a change.
Reference: Google Cloud: Service account key management best practices.
Evaluate alternatives
Compare each workload with supported attached identities or workload identity federation. A scheduled job running inside Google Cloud may not need a downloaded key at all. Check actual access requirements and deployment environment with its owner before migrating.
- Review who can create keys or impersonate the account.
- Check repository and distribution practices without exposing key contents.
- Record documented exceptions and their review dates.
Migrate or rotate safely
For a disposable workload, configure the approved replacement, verify the application with its intended permissions and then disable or revoke the test key according to the provider procedure. Recheck a known denied action. Use a planned recovery path before production rotation.
Respond to suspected exposure
Follow the organization's incident procedure, assess the affected account's permissions and logs, and revoke compromised credentials promptly through approved channels. Rotation alone does not explain whether an unauthorized party used the key.
Assessment limits
Key availability and migration methods depend on the workload and provider configuration. Rotation can interrupt dependent systems; do not copy private keys into an assessment report.
Frequently asked questions
Does rotating a key prove it was never used by an attacker?
No. Investigate relevant activity and exposure separately, and follow the incident process.
Is a service account's key as sensitive as its access?
Yes. A person possessing a usable key can authenticate as that account within the permissions and constraints that apply.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.