Safe Cleanup: How to use Policy Intelligence to Monitor and Retire GCP Service Account Keys

Photo by Amol Tyagi on Unsplash

One of the most nerve-wracking tasks for a Cloud Architect is “Key Cleanup Day.” You find a Service Account key created three years ago with no description. You want to delete it to reduce your attack surface, but you’re terrified that it’s quietly powering a mission-critical legacy script in a corner of your data center.

If you delete it and things break, it’s a disaster. If you leave it, it’s a security hole.

Google Cloud’s Policy Intelligence (specifically Activity Analyzer and Recommender) solves this “Delete-and-Pray” dilemma. It gives you the evidence you need to safely disable and eventually delete keys without disrupting your business.

Why Monitor Service Account Usage?

Before we dive into the “how,” let’s talk about the “why.”

• Credential Sprawl: Over time, projects accumulate dozens of keys. Each one is a potential entry point for an attacker if leaked.
• The “Secret Zero” Problem: Static keys are often hardcoded or stored in insecure places. Identifying which ones are actually still being used is the first step toward moving to more secure methods like Workload Identity.
• Audit Readiness: Compliance frameworks (SOC2, PCI) often require you to prove that you are auditing and rotating credentials.

Step 1: Enable the Right APIs

To use these features, you must ensure the following APIs are enabled in your project. Policy Intelligence tools are largely powered by the Recommender and Cloud Asset APIs.

1. Recommender API: recommender.googleapis.com (Generates the "unused" insights).
2. Cloud Asset API: cloudasset.googleapis.com (Powers the Policy Analyzer).
3. Policy Analyzer API: policyanalyzer.googleapis.com (Necessary for direct activity queries).

Cost Note: Good news! As of early 2026, Service Account Insights generated by Recommender are generally free for all customers. Policy Analyzer queries are also usually included in standard tier usage, though exporting results to BigQuery for long-term storage may incur standard BigQuery storage/query costs.

Step 2: Querying Activity for a Single Service Account

If you have a specific Service Account in mind, you can use the policy-intelligence command to see exactly when its keys were last used to authenticate a request.

To check the last authentication time for all keys of a specific Service Account:

gcloud policy-intelligence query-activity \
    --activity-type=serviceAccountKeyLastAuthentication \
    --project=[PROJECT_ID] \
    --query-filter='service_account="[SA_EMAIL]"'

What this tells you: This returns a list of Key IDs and a timestamp of their most recent usage. If a key hasn’t been used in 90 days, it is a prime candidate for disabling.

Step 3: Project-Wide Analysis (Find the “Lurkers”)

Instead of checking one by one, you can query the Recommender to find every service account in the project that has been “dormant” (unused) for the last 90 days.

To list all “Unused Service Account” insights in your project:

gcloud recommender insights list \
    --insight-type=google.iam.serviceAccount.Insight \
    --project=[PROJECT_ID] \
    --location=global

The Power of Insights: This doesn’t just show a date; it gives you a confidence score. Recommender uses machine learning to determine if an account is truly unused or if it just has a very long cycle (like a quarterly billing script).

Step 4: The “Safe-to-Delete” Workflow

Once you have your report, do not delete the keys immediately. Follow this best-practice workflow:

• Analyze: Use the commands above to identify keys with 0 usage in the last 90 days.
• Disable (The “Scream Test”): Instead of deleting, disable the key first.
• gcloud iam service-accounts keys disable [KEY_ID] \ --iam-account=[SA_EMAIL]
• Wait: Keep the key disabled for 7–14 days. If a critical system was using it, someone will “scream” (or an alert will fire). Because it’s only disabled, you can re-enable it instantly with one command to restore service.
• Delete: If no issues occur after the waiting period, you can confidently delete the key forever.

Closing Thoughts

Policy Intelligence turns security from a “guessing game” into a data-driven process. By using these tools, you move from being a “blocker” to an “enabler” — cleaning up the environment while guaranteeing that the lights stay on for the rest of the team.