Service account keys management in GCP - Step-by-Step Execution

Process Flow - Service account keys management

Create Service Account

↓

Generate Key for Account

↓

Store Key Securely

↓

Use Key for Authentication

↓

Rotate Key Periodically

↓

Delete Old/Unused Keys

↓

End

This flow shows how to create a service account, generate keys, use them securely, rotate keys regularly, and delete old keys to keep security strong.

Execution Sample

GCP

1. gcloud iam service-accounts create my-sa
2. gcloud iam service-accounts keys create key.json --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com
3. Use key.json in app
4. gcloud iam service-accounts keys list --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com
5. gcloud iam service-accounts keys delete KEY_ID --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com

This sequence creates a service account, generates a key, lists keys, and deletes a key.

Process Table

Step	Action	Command/Operation	Result/State Change
1	Create service account	gcloud iam service-accounts create my-sa	Service account 'my-sa' created
2	Generate key for 'my-sa'	gcloud iam service-accounts keys create key.json --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com	Key file 'key.json' created and downloaded
3	Use key in app	App uses 'key.json' to authenticate	App authenticated as 'my-sa'
4	List keys for 'my-sa'	gcloud iam service-accounts keys list --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com	Shows list of keys with IDs and creation dates
5	Delete old key	gcloud iam service-accounts keys delete KEY_ID --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com	Key with KEY_ID deleted
6	End	-	No further action

💡 All keys managed: created, used, listed, and deleted as needed to maintain security.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 4	After Step 5	Final
Service Account	None	my-sa created	my-sa with key generated	my-sa with keys listed	my-sa with key deleted	my-sa with updated keys
Key File	None	None	key.json created	key.json known	key.json deleted if old	No unused keys remain

Key Moments - 3 Insights

Why do we need to delete old service account keys?

Old keys increase security risk if leaked. Deleting them reduces attack surface. See execution_table step 5 where key deletion happens.

Can we use a service account without generating a key file?

Yes, if running on Google Cloud resources with default service accounts. But for external apps, keys are needed. Step 3 shows using the key file for authentication.

What happens if we lose the key file?

You cannot authenticate with that key anymore. You must create a new key and delete the lost one to keep security. See steps 2 and 5 for key creation and deletion.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after step 2?

A Key file 'key.json' created and downloaded

B App authenticated as 'my-sa'

C Service account 'my-sa' created

D Key with KEY_ID deleted

💡 Hint

Check the 'Result/State Change' column for step 2 in execution_table.

At which step do we remove an old key?

A Step 1

B Step 3

C Step 5

D Step 4

💡 Hint

Look for the action 'Delete old key' in execution_table.

If we skip step 5, what happens to the keys according to variable_tracker?

A No keys exist

B All keys remain, including old ones

C Only new keys exist

D Service account is deleted

💡 Hint

Check variable_tracker row for 'Key File' after step 5.

Concept Snapshot

Service account keys management:
- Create service account
- Generate keys for authentication
- Use keys securely in apps
- List keys to monitor
- Rotate and delete old keys regularly
- Keep keys safe to protect access

Full Transcript

This lesson shows how to manage service account keys in Google Cloud. First, create a service account. Then generate a key file to authenticate apps outside Google Cloud. Use the key file in your app to access resources. Regularly list keys to see which exist. Delete old or unused keys to keep your project secure. Losing keys means you must create new ones. Managing keys carefully protects your cloud resources.