Removed: the default ability to create persistent service account keys. For organizations created on or after 3 May 2024, Google Cloud enforces constraints/iam.disableServiceAccountKeyCreation (and iam.disableServiceAccountKeyUpload, and a block on handing default service accounts the Editor role) the moment the organization resource exists.
Outcome: a new Google Cloud organization starts with the long-lived credential type Google calls “a critical vulnerability exposing systems to potential breaches” switched off. Workloads authenticate through short-lived or keyless mechanisms instead; a team that genuinely cannot do without keys must weaken the policy deliberately, project by project.
Google announced the bundle in March 2024: the constraint “prevent[s] users from creating persistent keys for service accounts to decrease the risk of exposed service account credentials”, with the escape hatch spelled out — “allow an exception to use service account keys only for scenarios that cannot use any of the more secure alternatives”. The awkward part is that the defaults bind only new organizations (“Existing organization resources are not impacted by this change”), so most existing estates still hold every key they ever minted. A related default does reach them: from 16 June 2024, Google began automatically disabling service account keys detected in public repositories, for new and existing customers.
Sources:
- Google Cloud, Introducing stronger default Org Policies for our customers (20 March 2024)
- Google Cloud, Managing secure-by-default organization resources (documentation; retrieved 24 October 2026)
- Google Cloud, Automatically disabling leaked service account keys: what you need to know (15 May 2024)