Service account keys management in GCP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a service account key in Google Cloud?

A service account key is a special credential file that allows applications or users to authenticate as a service account to access Google Cloud resources securely.

intermediate

Why should you avoid long-lived service account keys?

Long-lived keys increase the risk of unauthorized access if the key is leaked. It's best to rotate keys regularly and delete unused keys to keep your environment secure.

intermediate

How can you rotate a service account key safely?

Create a new key, update your applications to use the new key, then delete the old key once the new key is confirmed working.

advanced

What is the recommended way to manage service account keys instead of downloading them?

Use Workload Identity Federation or Google Cloud IAM roles with short-lived tokens to avoid managing long-lived keys.

beginner

Where can you manage service account keys in Google Cloud Console?

In the Google Cloud Console, go to IAM & Admin > Service Accounts, select the service account, then go to the Keys tab to create, view, or delete keys.

What is the main risk of keeping service account keys for a long time?

A They can be leaked and used by attackers

B They expire automatically

C They slow down your application

D They increase your billing costs

Long-lived keys can be stolen and used by unauthorized users to access your cloud resources.

Which of the following is a best practice for service account key management?

A Share keys via email

B Use the same key for all projects

C Rotate keys regularly

D Never delete old keys

Regular key rotation reduces the risk of compromised keys being used.

Where do you find the option to create a new service account key in Google Cloud Console?

A Compute Engine > VM Instances

B IAM & Admin > Service Accounts > Keys tab

C Cloud Storage > Buckets

D Billing > Payment Settings

Service account keys are managed under IAM & Admin in the Service Accounts section.

What is a safer alternative to using service account keys for authentication?

A Disabling authentication

B Using user passwords

C Sharing keys publicly

D Workload Identity Federation

Workload Identity Federation allows short-lived credentials without managing long-lived keys.

What should you do after creating a new service account key for rotation?

A Delete the old key after updating applications

B Keep both keys active forever

C Share the key with everyone

D Ignore the new key

Deleting old keys after updating ensures no unused keys remain that could be compromised.

Explain the steps to safely rotate a service account key in Google Cloud.

Think about how to avoid downtime and security risks.

Describe why managing service account keys properly is important for cloud security.

Consider what happens if keys fall into the wrong hands.