Google Cloud service account keys: find and track their expiry

By default, user-managed service account keys never expire, which is a security risk in itself. An organization policy can set an expiry on newly created keys, and then a forgotten key breaks a pipeline on a fixed date.

List keys and their dates

For one service account:

gcloud iam service-accounts keys list \
  --iam-account=NAME@PROJECT.iam.gserviceaccount.com \
  --managed-by=user

The output includes when each key was created (CREATED_AT) and when it expires (EXPIRES_AT). A key with no expiry shows 9999-12-31T23:59:59Z.

Treat expiry as a feature

The organization policy constraint iam.serviceAccountKeyExpiryHours sets an expiry on newly created keys; existing keys keep their old expiry. Google advises against relying on it for production workloads. An expiry prompts the question of whether you need a key at all. Where possible, use workload identity federation or attached service accounts so no downloadable key exists to expire or leak.

If you do need a key

Record the service account, the key ID, the system that stores it and the owner. Rotate by creating a new key, deploying it, verifying, and then deleting the old key.

Questions

Do all keys expire?

No. By default, user-managed service account keys never expire. Only keys created under an expiry policy get an expiry date.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.