Lion Cipher Lab
Review Google Cloud service-account keys and plan their retirement (key age, last use, and keyless alternatives)
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A service-account key is a file that lets a program log in to Google Cloud as a robot user. By default it never expires, it works from anywhere on the internet, and it is easy to copy into a laptop, a CI variable or a public repository. Most cloud estates have dozens or hundreds of them, many on accounts with Owner or Editor power, and nobody remembers which ones are still needed. Google's own guidance is to avoid them. But the obvious cleanup, deleting every old key, takes production down, because old does not mean unused and a deleted key can never come back. In this lab you review a whole…
What you'll learn
- Telling user-managed service-account keys (your problem) from system-managed keys (Google's problem) in real key-list JSON
- Joining three data sources into one review: the key list, Activity Analyzer last-authentication records, and project IAM bindings
- Classifying keys into retirement buckets by age, last use, privilege, expiry and origin
- Scoring and ordering a retirement plan so the most dangerous keys go first
- Picking the keyless replacement for each workload type: attached service accounts, Workload Identity Federation, impersonation
- Measuring why disable-watch-delete beats delete-everything-old, and why a deleted key is a one-way door
- Locking the door afterwards with the key-creation, key-upload and key-expiry organization policy constraints
- Knowing what last-use data cannot tell you
Steps in this lab
- Service accounts and their keys, in plain words
- The three data sources a real key review joins
- Build the synthetic estate
- The review rules, and why each one exists
- Run the review
- Read the plan like a reviewer
- Measure it: delete everything old vs disable, watch, delete
- Lock the door: organization policy
- What last-use data cannot tell you
- When to use this, when not to, and how a pro does it