Skip to content
Sarj Sarj Sarj Standards

no-managed-service-account-key

Disallow Terraform-managed Google service-account keys.

SARJ211 Rule source Tests Catalog JSON

Why

Managed private keys persist in Terraform state and create long-lived credentials.

Fix

Use workload identity federation or service-account impersonation instead of creating a key.

Examples

Before — flagged A managed key creates persistent credentials
main.tf
resource "google_service_account_key" "app" { service_account_id = "app" }
After — preferred A service account needs no managed key
main.tf
resource "google_service_account" "app" { account_id = "app" }