How Do You Audit Service Account Keys Older Than 90 Days?
Short answer
D Use org-scoped gcloud asset search-all-resources with --asset-types="iam.googleapis.com/ServiceAccountKey" and createTime filter to audit keys over 90 days.
Question
Your organization has created hundreds of service accounts for different applications hosted on-premises and in other clouds that use Google Cloud APIs. You need to audit the service account keys that have been created and identify the keys that are older than 90 days. What should you do?
Key Takeaways
The question tests whether you can choose the correct Cloud Asset Inventory asset type for service account keys, and the trap is confusing them with API keys (apikeys.googleapis.com/Key) or with the service accounts themselves.
Auditing hundreds of service account keys across an organization requires Cloud Asset Inventory, not a project-scoped IAM list, because service account keys are exposed as the iam.googleapis.com/ServiceAccountKey asset type. This page establishes why option D is the only command that filters keys older than 90 days at organization scope.
Common mistake: The most common wrong answer is A: candidates remember search-all-resources and organization scope but select apikeys.googleapis.com/Key, which inventories API keys rather than service account keys.
Expert Analysis
Why the Answer Is Correct
Option D is correct because Cloud Asset Inventory's search-all-resources command can search at organization scope, and the asset type iam.googleapis.com/ServiceAccountKey represents service account keys with their createTime metadata. The --query "createTime < [DATE_90_DAYS_AGO]" filter isolates keys older than 90 days, and --order-by="createTime" makes the oldest keys easy to review. This is the only option that both spans the whole organization and targets service account keys rather than API keys or service accounts themselves. Mr_MIXER007 also selected this command and included the exact "iam.googleapis.com/ServiceAccountKey" asset type.Why the Other Options Are Wrong
Option A uses search-all-resources but with apikeys.googleapis.com/Key, which inventories API keys, not service account keys. Option B runs gcloud iam service-accounts list, which enumerates service accounts in a project, and its createTime reflects the service account, not any key attached to it. Option C invents "gcloud tans keys list", which is not a valid gcloud command and would not audit organization-wide service account keys. None of these combine organization scope with the ServiceAccountKey asset type.Community Comment Notes
The visible community input is sparse: Mr_MIXER007 voted for D and quoted the "iam.googleapis.com/ServiceAccountKey" asset type in the command. That aligns with the technical reasoning, but the single vote is not what makes D correct; the asset-type and scope requirements do. No commenter argued for A's apikeys.googleapis.com/Key asset type or for B's service-account listing, so there is no substantive counterargument to address.Official Reference
Exam Strategy
When a stem says organization-wide and asks about service account keys, first eliminate any project-scoped gcloud iam command and any API-key asset type. Then verify the Cloud Asset Inventory asset type is iam.googleapis.com/ServiceAccountKey and that the query uses createTime.
Frequently Asked Questions
Why not use gcloud iam service-accounts list for this audit?
It lists service accounts within a project, not their keys, and its createTime refers to the service account rather than any key. It also is not an organization-wide Cloud Asset Inventory search.
What asset type identifies service account keys in Cloud Asset Inventory?
Use iam.googleapis.com/ServiceAccountKey, not apikeys.googleapis.com/Key, which represents API keys. The ServiceAccountKey asset type exposes key metadata such as createTime for age filtering.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.
From public community threads 1
-
Mr_MIXER007 👍 1 Answered DD. Execute the gcloud asset search-all-resources --scope="organizations/[ORG_ID]" --query="createTime < [DATE_90_DAYS_AGO]" --asset-types="iam.googleapis.com/ServiceAccountKey" --order-by="createTime" command.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →