Scc Service Account Threat Detection Policies

What this solution is

This solution combines Security Command Center (SCC) Event Threat Detection (ETD), Google Cloud Organization Policy Service, and IAM Recommender to establish end-to-end detection, prevention, and remediation for service account security.

How it meets the requirements

• Automated threat detection: Event Threat Detection automatically ingests and evaluates IAM Admin Activity audit logs to uncover threats such as Privilege Escalation: Anomalous Multistep Service Account Delegation for Admin Activity and Privilege Escalation: Impersonation Role Granted for Dormant Service Account. It analyzes the delegation chain, identifying the initial caller and intermediary impersonated principals.
• Preventing credential exfiltration: Enforcing the organizational policy constraint iam.disableServiceAccountKeyCreation at the organization root blocks users and automation pipelines from generating user-managed private key files (.json), forcing workloads to use secure, short-lived tokens and workload identity federation.
• Investigation and remediation: When findings trigger, the finding details reveal the Principal email, Service account delegation information, and Cloud Logging URI to facilitate triage. Security teams can then leverage IAM Recommender to detect over-privileged or unused permissions on target service accounts and safely downscope access.

Key advantages and capabilities

• Deep delegation visibility: Unpacks nested impersonation hops to expose the true originating caller attempting privilege escalation.
• Proactive risk reduction: Eliminates long-lived static service account keys, neutralizing credential leakage vectors.
• Native log processing: Requires no external log shipping infrastructure or custom parsing rules for standard threat categories.
• Least-privilege enforcement: Couples threat alerting with automated role recommendation insights to remove dormant or excessive grants.

Why this is optimal

This approach directly aligns with Google Cloud security best practices by pairing preventive guardrails (Organization Policies) with continuous runtime threat detection (SCC Event Threat Detection) and intelligent rightsizing (IAM Recommender).