# 1.7 Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232884-1-7-ensure-user-managed-external-keys-for-service-accounts-are-rotated-every-90-days-or-fewer-automa - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) # Profile Applicability: # Level 1 ### Description: Service account keys, including a key ID and private key, are used to authenticate programmatic requests to Google Cloud services. It is recommended to rotate all user-managed (external) service account keys every 90 days to enhance security. Rationale: Rotating service account keys periodically reduces the risk of: 1. Unauthorized access due to a compromised, stolen, or lost key. 2. Prolonged exposure of old or vulnerable keys. Google Cloud Platform (GCP) automatically manages and rotates keys for service-to-service authentication. However, users must manage the rotation of external keys created for use outside of GCP. To facilitate this, GCP supports up to 10 keys per service account, enabling seamless key rotation. Impact: Rotating user-managed service account keys can disrupt dependent applications. Applications must be updated manually with the new key ID and corresponding private key to ensure continued functionality. **Default Value:** **By default, GCP does not automate the rotation of external (user-managed) service account keys. Key management is the user's responsibility.** # Remediation: **Using Google Cl****oud Console:** 1. **Navigate to APIs & Services > Credentials at [GCP Credentials Console](https://console.cloud.google.com/apis/credentials).**                                                                      **![](https://support.icompaas.com/assets/kb/7eac0484dae2e683.png)** 2. **Under the Service Account Keys section,Click on credentials. check the creation date of all external (user-managed) service account keys.**                                                                         **![](https://support.icompaas.com/assets/kb/f776adc1543257de.png)**                    **![](https://support.icompaas.com/assets/kb/2bbb1f7efe593c10.png)** 3. **Verify that all keys were created within the past 90 days.** **Using Google Cloud CLI:** **List all service accounts in a project:**  gcloud iam service-accounts list **For each service account, list the keys and check their validity:** gcloud iam service-accounts keys list --iam-account --format=json 1. **Ensure that the validAfterTime value for each key is within the past 90 days.** # **Implementation:** To Remove Old Keys (Using Google Cloud Console): 1. **Navigate to APIs & Services > Credentials at [GCP Credentials Console](https://console.cloud.google.com/apis/credentials).**                                             **![](https://support.icompaas.com/assets/kb/09332b993a7bc1d7.png)** 2. **Identify keys older than 90 days under the Service Account Keys section.** 3. **Delete outdated keys by clicking the Delete (Trash) icon.**                **![](https://support.icompaas.com/assets/kb/3ecac65ba336ec1c.png)** **To Create New Keys (Using Google Cloud Console):** 1. **Go to APIs & Services > Credentials.**                        **![](https://support.icompaas.com/assets/kb/27330d107b37d06a.png)** 2. **Click Create Credentials and select Service Account Key.**                       **![](https://support.icompaas.com/assets/kb/3f3c8f03934c0ffa.png)** 3. **Choose the desired service account from the dropdown list.**                **![](https://support.icompaas.com/assets/kb/4d26d8303c1c891c.png)** 4. **Select the key type format (****JSON or P12) and click Create.**             **![](https://support.icompaas.com/assets/kb/2d8ff2b4d95032d2.png)** **![](https://support.icompaas.com/assets/kb/f18d5c416f8db1ad.png)** 5. **Download the private key and store it securely.** **![](https://support.icompaas.com/assets/kb/d156a5ddabe7022e.png)** 6. **Note the new key ID displayed in the Service Account Keys section.** **![](https://support.icompaas.com/assets/kb/6bf3d50eb340bd7f.png)** **Using Google Cloud CLI:** Delete Old Keys:  gcloud iam service-accounts keys delete --iam-account Create a New Key:  gcloud iam service-accounts keys create --iam-account ## **Backout Plan:** 1\. Restore a Deleted Key (If Necessary) If an old key was removed too early, reassign a new key: gcloud iam service-accounts keys create --iam-account= - Update applications with the new key file. 2\. Temporarily Allow External Key Creation If needed, temporarily allow key creation: gcloud resource-manager org-policies disable-enforce constraints/iam.disableServiceAccountKeyCreation --organization=ORG\_ID - Re-enable enforcement once the issue is resolved. **References:** 1. **[Managing Service Account Keys](https://cloud.google.com/iam/docs/understanding-serviceaccounts#managing_service_account_keys)** 2. **[Listing Service Account Keys](https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/list)** 3. **[Google IAM Service Accounts](https://cloud.google.com/iam/docs/service-accounts)** # **Additional Information:** - **Key rotation for user-managed service account keys is entirely the user's responsibility.** - **Ensure secure handling of downloaded private keys to prevent unauthorized access.** # **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

Explicitly Not Mapped

No explicit mapping to CIS Controls.

❌

❌

❌

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.