Please tell me about the 6/16 organizational policy change.

[sum]

Hello.
Right now our team is creating a project without an organization set up in GCP. We are using a service account for that project.

I believe the 6/16 organization policy change states that if an account key is compromised in a public environment, a deactivation action will be taken.

For projects that have not set up an organization, what action will be taken after 6/16 in the unlikely event that a service account key is compromised in a public environment?

[RonEtch]

Hi @sum 

Welcome to Google Cloud Community!

It is not explicitly explained that non-org projects will not be affected of the changes, knowing that this policy is inherited from organization to projects.

Based on the docs, Google Cloud occasionally detects exposed SA keys and you can set your project constraints "Service account key exposure response" to DISABLE_KEY to automatically disable the key.

I hope this information is helpful.

If you need further assistance, you can always file a ticket on our support team.

[sum]

Hi RonEtch
Thanks for your response.

If the SA Key of a project not belonging to the organization is compromised after 6/16, does it automatically stop? Or will I get a warning email?

The document you gave me talks about organization settings, but it doesn't talk about settings on a per-project basis... I would like to know.