Policy: GCP > CIS v2.0 > 1 - Identity and Access Management > 1.07 - Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer

Configures auditing against a CIS Benchmark item.

Level: 1

Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account. It is recommended that all Service Account keys are regularly rotated.

Resource Types

This policy targets the following resource types:

GCP > IAM > Service Account Key

Primary Policy

This policy is used with the following primary policy:

GCP > CIS v2.0 > 1 - Identity and Access Management

Controls

Policy Specification

Schema Type	`string`
Default	`Per GCP > CIS v2.0 > 1 - Identity and Access Management`
Valid Values [YAML]	`Per GCP > CIS v2.0 > 1 - Identity and Access Management` `Skip` `Check: Benchmark`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v071602

Policy Type URI

tmod:@turbot/gcp-cisv2-0#/policy/types/r0107

GraphQL

query policyType(id: "tmod:@turbot/gcp-cisv2-0#/policy/types/r0107") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv2-0#/policy/types/r0107'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv2-0#/policy/types/r0107'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/gcp-cisv2-0#/policy/types/r0107"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv2-0#/policy/types/r0107"