Recent changes?

zinger

Hey,

From what i see some folks are experiencing with issues while creating keys for service accounts even being Admin/Owner. Same problem. The interesting thing that i was able to do it even a month ago (I'm an Owner). Now creation key policy is disabled. Did i miss this annonsment or update? Could someone share it? Thank you in advance

Thank you

DamianS

Hello @zinger ,

Welcome on the Google Cloud Community. I've found entry in release notes saying something about secure-by-default org policy enforcement around Feb 5 2024

I've search for secure-by-default phrase and got this: https://cloud.google.com/resource-manager/docs/secure-by-default-organizations#:~:text=The%20secure%....

So it looks like Google have a enforcement action for all organizations at this moment, which enabling SA keys creation. I think it's becuase SA keys without proper policy of keys rotation are against security best practices ( WIF is more secured in this matter).

cheers,
DamianS

zinger

hello, Damian and thank you for quick reply!

Now it's getting even more confusing: turned out i have no organization at all. Does it mean i have to create it first and as a super admin change policies?

DamianS

It's quite confusing also for me. You can't assign org policies without having org in place. However it looks like those Org policies are set by default to enforce. Let me ask, did you've been invited to those project by anybody else, or you just using your billing card, and without any org dealing with cloud ?

cheers,

DamianS

DamianS

Additionally I've created issue ticket regarding this: https://issuetracker.google.com/issues/335695517

zinger

i've been invited, you're right. the point is that even the project owner can't disable this policy (lack of permissions). thank you for your help, keeping an eye on the ticket

DamianS

Basically to deal with Org Policies you must have

roles/orgpolicy.policyAdmin

assigned to your IAM user. So even if you are Org Admin, which have more permissions than Project Admin or ( Owner ) you will not be able to deal with policies. If the person who invited you, is able to grant

roles/orgpolicy.policyAdmin

and then make an exception based on tag to your project, SA keys creation functionality will be restored. But if you don't want to utilize keys anymore due to security reason, highly recommend to use Workload Identity Federations instead of service keys.

Grab the cli command to grant mentioned role

gcloud organizations add-iam-policy-binding YOUR_ORG_ID --member='user:YOUR_EMAIL' --role='roles/orgpolicy.policyAdmin'

zinger

For some reason the person who's invited me can't assign OrgAdm role to me:

Now i'm trying to move this project (under "No organization") to existing org, which is another journey. So far no luck..

DamianS

Hi,

yep. This error means, that only principals in trusted polices can be added to IAM. So, you must check which domains are whitelisted at policy constraint and add principal with that policy or add domain where your user has been created like @example.com or @company2.com and then you will be able to be added.