Disable User Managed Key Creation Service Account Fix

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Disable User-Managed Key Creation for Service Accounts" for GCP using GCP console, please follow the below steps:

1. Open the GCP Console and navigate to the IAM & Admin page.
2. Click on the "Service Accounts" tab.
3. Select the Service Account for which you want to disable User-Managed Key Creation.
4. Click on the "Edit" button in the Service Account details page.
5. Scroll down to the "Key Management" section and click on the "Show More" link.
6. Under the "Key Management" section, you will see an option "User-managed keys". Disable this option.
7. Click on the "Save" button to save the changes.

By following these steps, you will successfully remediate the misconfiguration "Disable User-Managed Key Creation for Service Accounts" for GCP using GCP console.

Using CLI

To remediate the misconfiguration "Disable User-Managed Key Creation for Service Accounts" for GCP using GCP CLI, follow the below steps:

Step 1: Open the Google Cloud Shell or Terminal window.

Step 2: Run the following command to check the current status of User-Managed Key Creation for Service Accounts:

gcloud iam service-accounts get-iam-policy [SERVICE_ACCOUNT_EMAIL] --format=json > policy.json

Replace [SERVICE_ACCOUNT_EMAIL] with the email address of the service account for which you want to check the User-Managed Key Creation status.

Step 3: Open the policy.json file in an editor and check the "bindings" section for the following entry:

"members": [
    "user:*",
    "serviceAccount:*",
    "group:*"
],
"role": "roles/iam.serviceAccountKeyAdmin"

If this entry is present, it means that User-Managed Key Creation is enabled for the service account.

Step 4: To disable User-Managed Key Creation, run the following command:

gcloud iam service-accounts set-iam-policy [SERVICE_ACCOUNT_EMAIL] policy.json --quiet

Replace [SERVICE_ACCOUNT_EMAIL] with the email address of the service account for which you want to disable User-Managed Key Creation.

Step 5: Open the policy.json file in an editor and remove the following entry from the "bindings" section:

{
    "members": [
        "user:*",
        "serviceAccount:*",
        "group:*"
    ],
    "role": "roles/iam.serviceAccountKeyAdmin"
}

Step 6: Save the policy.json file and run the following command to update the policy for the service account:

gcloud iam service-accounts set-iam-policy [SERVICE_ACCOUNT_EMAIL] policy.json --quiet

Replace [SERVICE_ACCOUNT_EMAIL] with the email address of the service account for which you want to update the policy.

After following these steps, User-Managed Key Creation will be disabled for the specified service account.

Using Python

To remediate the misconfiguration "Disable User-Managed Key Creation for Service Accounts" in GCP using Python, follow these steps:

1. Import the required libraries:

from googleapiclient import discovery
from google.oauth2 import service_account

2. Set up the credentials for the service account that has the necessary permissions to make changes to the GCP project:

credentials = service_account.Credentials.from_service_account_file(
    '/path/to/service_account_key.json')

3. Create a ServiceUsage client object:

serviceusage = discovery.build('serviceusage', 'v1', credentials=credentials)

4. Retrieve the current state of the iam.googleapis.com service:

service_name = 'iam.googleapis.com'
parent = 'projects/PROJECT_ID'
services = serviceusage.services().list(parent=parent).execute()
service = next((s for s in services['services'] if s['config']['name'] == service_name), None)

5. Check if user-managed keys are currently allowed for service accounts:

if 'iam.googleapis.com/allowServiceAccountKeyCreation' not in service['config']['acquirerSettings']:
    print('User-managed keys are already disabled for service accounts.')
else:
    print('User-managed keys are currently allowed for service accounts.')

6. If user-managed keys are currently allowed, update the service configuration to disable them:

if 'iam.googleapis.com/allowServiceAccountKeyCreation' not in service['config']['acquirerSettings']:
    print('User-managed keys are already disabled for service accounts.')
else:
    print('Disabling user-managed keys for service accounts...')
    service['config']['acquirerSettings']['iam.googleapis.com/allowServiceAccountKeyCreation'] = False
    serviceusage.services().patch(name=service['name'], body=service).execute()
    print('User-managed keys have been disabled for service accounts.')

Note: Replace PROJECT_ID with the ID of the GCP project you want to remediate. Also, make sure that the service account key file (service_account_key.json) has the necessary permissions to make changes to the GCP project.

Using Terraform

# Disable user-managed service account key creation at the PROJECT level
resource "google_project_organization_policy" "disable_sa_user_keys_project" {
  project    = "YOUR_PROJECT_ID" # e.g. "my-prod-project"
  constraint = "constraints/iam.disableServiceAccountKeyCreation"

  boolean_policy {
    enforced = true
  }
}

# (Alternative) Disable at the ORGANIZATION level instead of a single project
# Use this if your finding is scoped to the entire org.
resource "google_organization_policy" "disable_sa_user_keys_org" {
  org_id     = "YOUR_ORGANIZATION_ID" # e.g. "123456789012"
  constraint = "constraints/iam.disableServiceAccountKeyCreation"

  boolean_policy {
    enforced = true
  }
}

# (Alternative) Disable at the FOLDER level
# Use this if the finding is scoped to a folder.
resource "google_folder_organization_policy" "disable_sa_user_keys_folder" {
  folder     = "FOLDERS/YOUR_FOLDER_ID" # e.g. "folders/345678901234"
  constraint = "constraints/iam.disableServiceAccountKeyCreation"

  boolean_policy {
    enforced = true
  }
}

This change is in-place and does not force replacement of existing projects/folders/organizations, but it will immediately block creation of new user-managed service account keys in the scoped resources.

Verification: terraform plan should show a new google_*_organization_policy resource with constraint = "constraints/iam.disableServiceAccountKeyCreation" and boolean_policy.enforced = true.