Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Disable User-Managed Key Creation for Service Accounts

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: High (not acceptable risk)
Rule ID: ResourceManager-001

Ensure that the creation of user-managed service account keys is disabled within your Google Cloud project, folder, or the entire organization through the "Disable Service Account Key Creation" organization policy. This allows you to control the use of unmanaged long-term credentials for your Cloud IAM service accounts. When this resource constraint is enabled, user-managed keys cannot be created for service accounts in projects/folders/organizations affected by the constraint.

This rule resolution is part of the Conformity Security & Compliance tool for GCP.

Security

User-managed keys are extremely powerful credentials, and they can pose a security risk if they are not managed correctly. If the user-managed service account keys are compromised, anyone who has access to these credentials will be able to access your Google Cloud Platform (GCP) resources through their associated service account. You can limit their use by applying the "Disable Service Account Key Creation" (i.e. iam.disableServiceAccountKeyCreation) organization policy to projects, folders, or your entire organization. After applying the constraint, you can enable user-managed keys in well-controlled locations, to minimize the potential risk caused by the unmanaged keys.

Note: As example, this conformity rule demonstrates how to disable the creation of new user-managed service account keys at the Google Cloud organization level.

Audit

To determine if the creation of user-managed service account keys is disabled for your GCP organizations, perform the following actions:

Using GCP Console

01 Sign in to Google Cloud Management Console with the organizational unit credentials.

02 Click on the deployment selector from the top navigation bar, select ALL to list all the existing deployments, then choose the Google Cloud organization that you want to examine.

03 Navigate to Cloud Identity and Access Management (IAM) dashboard at https://console.cloud.google.com/iam-admin/iam.

04 In the navigation panel, select Organization Policies to access the list with the cloud organization policies available for your GCP organization.

05 Click inside the Filter by policy name or ID filter box, select Name and Disable service account key creation to return only the "Disable Service Account Key Creation" policy.

06 Click on the name of the organization policy returned at the previous step.

07 On the Policy details page, under Effective policy, check the Enforcement configuration attribute status. If the Enforcement attribute status is set to Not enforced, the policy is not enforced within your organization, therefore the creation of user-managed (external) service account keys is not disabled for the selected Google Cloud organization.

08 Repeat steps no. 2 – 7 for each organization available in in your Google Cloud account.

Using GCP CLI

01 Run organizations list command (Windows/macOS/Linux) using custom query filters to list the ID of each Google Cloud Platform (GCP) organization available in your Google Cloud account: 

gcloud organizations list
	--format="table(name)"

02 The command output should return the requested organization identifiers (IDs): 

ID
112233441122
123412341234

03 Run resource-manager org-policies describe command (Windows/macOS/Linux) using the ID of the GCP organization that you want to reconfigure as identifier parameter, to describe the enforcement configuration of the "Disable Service Account Key Creation" policy (i.e. "iam.disableServiceAccountKeyCreation "), available for the selected organization: 

gcloud alpha resource-manager org-policies describe "iam.disableServiceAccountKeyCreation"
	--effective
	--organization=112233441122
	--format="table(booleanPolicy)"

04 The command request should return the requested configuration information: 

BOOLEAN_POLICY
{}

If the resource-manager org-policies describe command output returns an empty object for the BOOLEAN_POLICY configuration attribute, as shown in the example above, the "Disable Service Account Key Creation" policy is not enforced at the organization level, therefore the creation of user-managed (external) service account keys is not disabled for the selected Google Cloud organization.

05 Repeat step no. 3 and 4 for each organization created within in your Google Cloud account.

Remediation / Resolution

To ensure that the user-managed key creation for Cloud IAM service accounts is disabled within your Google Cloud organization, enable the "Disable Service Account Key Creation" organization policy, by performing the following actions:

Using GCP Console

01 Sign in to Google Cloud Management Console with the organizational unit credentials.

02 Click on the deployment selector from the top navigation bar, select ALL to list all the existing deployments, then choose the Google Cloud organization that you want to reconfigure.

03 Navigate to Cloud Identity and Access Management (IAM) dashboard at https://console.cloud.google.com/iam-admin/iam.

04 In the navigation panel, select Organization Policies to access the list with the cloud organization policies available for your organization.

05 Click inside the Filter by policy name or ID box, select Name and Disable Service Account Creation to list only the "Disable Service Account Key Creation" policy.

06 Click on the name of the organization policy listed at the previous step.

07 On the Policy details page, click on the EDIT button from the dashboard top menu to edit the selected policy.

08 On the Edit policy configuration page, perform the following operations:

  1. Under Applies to, select Customize to choose the type of the policy to apply (i.e. customized policy).
  2. Under Enforcement, select On to enforce policy constraint. This constraint disables the creation of new user-managed keys for Cloud IAM service accounts within the selected Google Cloud organization.
  3. Click SAVE to apply the changes and enforce the "Disable Service Account Key Creation" policy constraints.

09 If required, repeat steps no. 2 – 8 to enable the policy for other organizations available in your Google Cloud account.

Using GCP CLI

01 Run resource-manager org-policies enable-enforce command (Windows/macOS/Linux) using the ID of the Google Cloud Platform (GCP) organization that you want to reconfigure as identifier parameter, to enforce the "Disable Service Account Key Creation" policy (i.e. "iam.disableServiceAccountKeyCreation") for the selected organization: 

gcloud alpha resource-manager org-policies enable-enforce "iam.disableServiceAccountKeyCreation"
	--organization=112233441122

02 The command request should return the reconfigured organization policy metadata: 

booleanPolicy:
  enforced: true
constraint: constraints/iam.disableServiceAccountKeyCreation
etag: aabbccddabcd
updateTime: '2020-06-20T15:00:00.000Z'

03 If required, repeat step no. 1 and 2 to enforce the policy for other organizations created within your Google Cloud account.

References

Publication date Apr 21, 2021

Related ResourceManager rules