Audit Service Account Key Inventory Usage Alerts

What this architecture is

This architecture combines Cloud Asset Inventory, Policy Intelligence (IAM key insights/recommenders), and Cloud Logging aggregated sinks with Cloud Monitoring to establish full lifecycle visibility, inactivity detection, and real-time detection of user-managed service account key creation across an entire organization.

How it meets the requirements

• Organization-Wide Inventory & Age Tracking: Cloud Asset Inventory provides a centralized metadata repository across all projects under an Organization node. Exporting or querying assets of type iam.googleapis.com/ServiceAccountKey reveals all existing user-managed keys, their associated service accounts, parent projects, and creation timestamps (validAfterTime).
• Unused Key Identification: IAM Policy Intelligence continuously monitors service account key authentication activity. It surfaces service account key insights and recommendations identifying keys that have not been used to authenticate API requests over observation windows (such as 90 days), allowing security teams to confidently disable and delete inactive credentials.
• Real-Time Alerting on Key Creation: An organization-level aggregated log sink captures cloudaudit.googleapis.com/activity logs across all child folders and projects. Filtering for protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey" captures all key creation events instantly and routes them to a Pub/Sub topic and Cloud Monitoring log-based alert for automated SOC notification.

Key advantages and capabilities

• Centralized governance: Eliminates the need to poll individual project IAM APIs iteratively.
• Detective automation: Policy Intelligence automatically correlates activity without requiring custom log parsing of high-volume data streams.
• Immutable audit trails: Admin Activity logs are recorded automatically without ingest costs and cannot be disabled by project-level users.

Why this is optimal

This approach uses Google Cloud-native governance and intelligence tools at the organization hierarchy root, ensuring zero blind spots across newly created or existing projects.