Glossary term
Service account key
A user-managed key pair letting anyone who holds the private key (usually a JSON file) authenticate as a Google Cloud service account from anywhere.
A user-managed service account key is an RSA key pair attached to a service account. The private half is usually downloaded as a JSON key file; whoever holds it can authenticate as the service account from any machine, without MFA, and by default without expiry.
Creation is logged as google.iam.admin.v1.CreateServiceAccountKey (or UploadServiceAccountKey for an externally generated public key). Every call authenticated with the key carries authenticationInfo.serviceAccountKeyName, ending with the key ID, which lets investigators list every IP that used it. Google recommends avoiding keys (iam.disableServiceAccountKeyCreation) and automatically disabling exposed ones (iam.serviceAccountKeyExposureResponse).