User-managed service account keys should be used within the allowed inactivity period
User-managed service account keys with no recorded activity during the last `max_unused_account_days` are identified using key-usage metrics per service account. Prowler check iam_sa_user_managed_key_unused reports such stale keys.
Stale user-managed keys expand exposure of long-lived credentials. If leaked, an attacker can authenticate as the service account off-platform, bypass network controls, access data, alter resources, and persist.
What this control checks
Checks user-managed service account keys for inactivity
Audit evidence
Evidence that deployed resources meet this control: Prowler check iam_sa_user_managed_key_unused (prowler gcp --checks iam_sa_user_managed_key_unused).
Framework-specific interpretation
SOC 2: Mapped to CC6.3 (The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets...).
NIS2 Directive (EU 2022/2555): Mapped to 11.5.4 (The relevant entities shall regularly review the identities for network and information systems and their users and, if...), 6.2.2.b (apply principles for engineering secure systems and secure coding principles to any information system development...), 9.2.c (the relevant entities approach to key management, including, where appropriate, methods for the following:) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 11 Access control
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OPS-05.02AC Policies and instructions describe the technical measures taken to securely configure and monitor the management console (both the customer's self-service and the service provider's cloud administration) to protect it from malware.
- 164.308(a)(3)(i) Workforce security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_iam_sa_user_managed_key_unused - Prowler Check:
iam_sa_user_managed_key_unused
Last reviewed: 2026-10-09