[Action Advised] Automatically disable publicly exposed Service Account keys

[hlindqvist]

I just got an email saying Google will proactively disable any publicly exposed "Service Account Keys" that they become aware of after June 16, 2024, unless i opt-out. But i'm unable to do so since that can only be done at/on "Organization" level/resource, which my account lacks due to it being ancient, before such features/requirements, and solely registered to be used with OAuth and Google/Firebase Cloud Messaging for an Android app.

Do "Service Account Keys" also mean API keys as included in an APK by the google-services-plugin? For which i've previously received warnings about it being exposed, but apps are of course unable to hide.

If so, then i need to opt-out, how do i do so without an "Organization level" in "Organization Policies"?

If an "Organization" is needed, what is the easiest way to set one up?

Is setting up an "Organization" a free service?

Will setting up an "Organization" break existing projects, e.g. currently used API keys, etc.?

[GJX97]

Hello

I am in the same boat as yourself, slightly worried that I may have break my projects by creating the organisation. 

Did you get an answer on this? 

[Bitdoctor]

No real answer yet. It seems the apps, if we select each app and choose 'Migrate,' will remain intact (all settings and config), but will then be subject to whatever "default policies" or "explicit policies" defined in the Org that you create. To me, that says that, IF this new "public key exposure" setting is a default policy then, once you migrate to the org, you can then choose to override that (basically like "removing inheritance") and then put in place the "WAIT-FOR-ABUSE" policy. So, unless there's some really strict policy in place, then the "raw Org default policies" should be basically the same as your existing policies under "No Organization." This advice is given with no express nor implied warranties of merchantability - YMMV. Please reply back if you do move them, and let us know the results! Thank you.

[Bitdoctor]

Personally (and professionally), I feel that Google dropped the ball on this one, by being very vague and also providing unclear instructions; since I'm sure they realize that DROVES of people are stuck in "No Organization" land, and they've completely ignored that fact. They should have an entire section devoted to: "If your apps currently are not under an Organization, you must migrate them to an Organization, in order to set the "WAIT_FOR_ABUSE" policy (or any other policy)."

[Bitdoctor]

Same here! I actually HAVE an organization, but the original owner of the space created all his apps before the org, so they never were moved under the org. WILL THEY BREAK? I see that we can do "Migrate" and move the apps under the Org, but what is the impact? VERY DISAPPOINTING that there are no experts replying on here - and the support is just too darned expensive!