Rotate User-Managed Service Account Keys (2024)

Security

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the GCP project that you want to examine from the console top navigation bar.

03 Navigate to Cloud Identity and Access Management (IAM) console at https://console.cloud.google.com/iam-admin/iam.

04 In the main navigation panel, select Service Accounts.

05 Click on the email (link) of the user-managed service account that you want to examine.

06 Select the KEYS tab to access the user-managed key(s) associated with the selected service account.

07 Check the date available in the Key creation date column for each active user-managed key listed in the Keys section. If there are active user-managed keys older than maximum allowed age (recommended 90 days), follow the steps outlined in the Remediation/Resolution section to rotate those keys in order to maintain a secure programmatic access to your GCP cloud resources.

08 Repeat steps no. 5 – 7 for each user-managed service account that you want to examine, created for the selected GCP project.

09 Repeat steps no. 2 – 8 for each project deployed in your Google Cloud Platform (GCP) account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom query filters to describe the ID of each project deployed within your GCP account:

gcloud projects list--format="table(projectId)"

02 The command output should return the requested GCP project identifiers:

PROJECT_IDcc-web-app-prod-123123cc-project5-app-123123cc-internal-app-123123

03 Run iam service-accounts list command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as the identifier parameter and custom query filters to describe the email address of each user-managed service account created for the selected project:

gcloud iam service-accounts list --project=cc-web-app-prod-123123 --format="table(email)"

04 The command output should return the corresponding email addresses:

EMAILcc-devops-account@cc-web-app-prod-123123.iam.gserviceaccount.comcc-testing-account@cc-web-app-prod-123123.iam.gserviceaccount.com

05 Run iam service-accounts keys list command (Windows/macOS/Linux) using the email address of the service account that you want to examine as the identifier parameter, to describe the creation date of each user-managed key associated with the selected service account:

gcloud iam service-accounts keys list --iam-account=cc-devops-account@cc-web-app-prod-123123.iam.gserviceaccoung.com --managed-by=user --format="table(name,validAfterTime)"

06 The command output should return the ID and the creation date for each available key:

KEY_ID: abcd1234abcd1234abcd1234abcd1234abcd1234CREATED_AT: 2021-12-14T18:03:22Z

Check the creation date returned by the CREATED_AT attribute for each user-managed key associated with the selected account. If one or more user-managed keys have the creation date older than the maximum allowed age (recommended 90 days), follow the steps outlined in the Remediation/Resolution section to rotate those keys in order to maintain a secure programmatic access to your GCP cloud resources.

07 Repeat steps no. 5 and 6 for each user-managed service account that you want to examine, created for the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed within your Google Cloud Platform (GCP) account.

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the GCP project that you want to examine from the console top navigation bar.

03 Navigate to Cloud Identity and Access Management (IAM) console at https://console.cloud.google.com/iam-admin/iam.

04 In the main navigation panel, select Service Accounts.

05 Click on the email (link) of the user-managed service account that you want to access.

06 Create a new, external key, required to replace the old one. Select the KEYS tab and perform the following operations:

1. Choose ADD KEY and select Create new key to initiate the key setup.
2. In the Create private key for "<service-account-name>" configuration box, select JSON or P12 (for backward compatibility only) for the Key type, then choose CREATE to create the new user-managed key.
3. Save the associated private key to a safe location on your computer, then choose CLOSE to return to the IAM console.

07 Configure the key-dependent application(s) in order to reference the new external key ID displayed in the Key column and the private key downloaded at the previous step.

08 Once the new user-managed (external) key is referenced within your application(s) code, navigate back to your service account page, select the KEYS tab, and remove the old (non-compliant) key by performing the following actions:

1. Chose the non-compliant user-managed key that you want to remove and click on the delete icon available next to the selected key.
2. In the Delete key ID confirmation box, review the key details, then choose DELETE to confirm the removal.

09 Repeat steps no. 6 – 8 to rotate other external keys that are older than the maximum allowed age (recommended 90 days), associated with the selected service account.

10 Repeat steps no. 5 – 9 for each user-managed service account created for the selected GCP project.

11 Repeat steps no. 2 – 10 for each project deployed within your Google Cloud Platform (GCP) account.

Using GCP CLI

01 Run iam service-accounts keys create command (Windows/macOS/Linux) using the email address of the service account that you want to access as the identifier parameter, to create a new external key, required to replace the old (non-compliant) one. Provide a name (e.g. private-key.json) for the JSON file that will store the private key:

gcloud iam service-accounts keys create --iam-account=cc-devops-account@cc-web-app-prod-123123.iam.gserviceaccoung.com --key-file-type json private-key.json

02 The command output should return the ID of the newly created key:

created key [abcdabcdabcd1234123412234abcdabcdabcdacd] of type [json] as [private-key.json] for [[email protected]]

03 Run iam service-accounts keys delete command (Windows/macOS/Linux) using the email address of the service account that you want to access and the ID of the old, corresponding key as the identifier parameters, to delete the non-compliant user-managed key:

gcloud iam service-accounts keys delete --iam-account=cc-devops-account@cc-web-app-prod-123123.iam.gserviceaccoung.comabcd1234abcd1234abcd1234abcd1234abcd1234

04 The iam service-accounts keys delete command should ask you for confirmation. Type Y to confirm the key removal. Once removed, the command output should return the ID of the deleted key:

deleted key [abcd1234abcd1234abcd1234abcd1234abcd1234] for service account [[email protected]]

05 Repeat steps no. 1 – 4 to rotate other external keys that are older than 90 days, associated with the selected service account.

06 Repeat steps no. 1 – 5 for each user-managed service account created for the selected GCP project.

07 Repeat steps no. 1 – 6 for each project deployed in your Google Cloud Platform (GCP) account.