Audit Impersonation Service Account Delegation Info

What the Solution Is

This solution pairs deep Cloud Audit Log inspection of the serviceAccountDelegationInfo metadata structure with the organization-wide policy constraint constraints/iam.disableServiceAccountKeyCreation to enforce identity traceability and eliminate static credential leakage.

How It Meets the Requirements

• Tracing originating caller identity: When an identity impersonates a service account using short-lived credentials (such as OAuth2 access tokens generated via generateAccessToken), Cloud Audit Logs record the impersonated service account in protoPayload.authenticationInfo.principalEmail. Crucially, the actual originating caller or sequence of delegates is populated in protoPayload.authenticationInfo.serviceAccountDelegationInfo, allowing forensic investigators to pinpoint the exact human user who initiated the action.
• Preventing credential exfiltration: Enforcing the boolean constraint iam.disableServiceAccountKeyCreation blocks developers and administrators from creating user-managed, downloadable RSA private keys (.json or .p12 files). This mandates the use of short-lived credential generation, identity federation, or direct impersonation patterns, removing long-lived static keys that could otherwise be leaked or stolen from developer workstations.

Key Advantages and Capabilities

• Unbroken chain of custody: Captures full multi-hop delegation chains across service accounts and human principals in structured JSON audit fields.
• Elimination of static credential risk: Shuts down the primary attack vector for credential theft and lateral movement by disallowing user-managed service account key downloads.
• Non-repudiation: Ensures that privileged operations executed by service accounts can always be tied back to the authorized user who requested the impersonation token.
• Least privilege enforcement: Allows users to execute high-privilege tasks temporarily via impersonation rather than assigning persistent standing IAM privileges directly to user accounts.

Why This Is Optimal

Inspecting serviceAccountDelegationInfo is the only Google Cloud native logging mechanism that captures the full delegation lineage during service account impersonation. Combining this detective control with the preventive guardrail iam.disableServiceAccountKeyCreation achieves full zero-trust credential hygiene by replacing vulnerable static keys with short-lived, fully auditable impersonated credentials.