Service account key creation is disabled

[edwardlee3920]

I am getting this error when trying to create a service account key in a Google Cloud Project:

The organization policy constraint 'iam.disableServiceAccountKeyCreation' is enforced. This constraint disables the creation of new service account keys. Learn more about disabling service account key creation. 

https://share.cleanshot.com/TW8JzFvT

[DamianS]

Hi @edwardlee3920 ,

Where is the problem then ? Your Organization Admin disabled SA key creation. So you must either use [1]Workload Identity Federation to use Service Account or ask your Org Admin to get exception for your project. 

[1.]https://cloud.google.com/iam/docs/workload-identity-federation

cheers,
DamianS

[MarkJP]

Hi Damian - As you can see from my original post - My knowledge about the Dev console is next to nothing.  I believe that there are now three of us seeing the same issue, and suspect this is due to a change introduced by Google, I'm guessing about a month ago.  This is not something that has been turned on by any member of our companies.  If you have any in depth knowledge of the dev console can you give some guidance on how this organisation policy can be updated.

[DamianS]

Well,

As I said at first response, use WIF instead of service keys. It's more secured and better way to use Service Accounts 🙂 

But if you want to change Org Policy:

Login as Org Admin -> IAM -> Organization policies -> Search for "Disable service account key creation".  Click on it -> MANAGE POLICY -> Edit policy as you want -> SET POLICY

cheers,
DamianS

[MarkJP]

Thanks so much for that - I understand what you are saying regards WIF, however I need to use a service Key, ass this is what the other systems requires.
The problem I have is that I need to assign Org Admin rights to myself to make this change.  I will give that a go.  I managed to assign the owner role at the organisation level - this allowed me to try to edit - but got an error when trying to save,

[DamianS]

Lovely 🙂 What error did you received ? 

Also remember, that to be able to deal with Org Policies, you must have roles/orgpolicy.policyAdmin assigned at ORG Level into your principal.
More info here: 
https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints

cheers,
DamianS

[DamianS]

Owner might be not sufficient as you need 

"orgpolicy.policies.update , orgpolicy.policy.get ,orgpolicy.policy.set " to be able to edit Org Policies.  

cheers,

DamianS

[MarkJP]

I have the exact same problem.  I believe this is due to a change made by Google.  I am using and account that is a super admin, and an owner of the project.  I know very little of the dev console mechanics and only use it to create service keys to allow directory searches for another system.  I manage a number of Google workspaces and can confirm this is true for all the domains I have tried.  What I think I have worked out is that permissions on the project are inherited from the parent organisation level.  When I gave myself the owner role at the organisation level I was able to click the edit option for the policy I wanted to change "Disable service account key creation" - but got an error when I tried to save.  Any help gratefully received.

[MarkJP]

Hi Edward - did you get anywhere with this?

[balismail]

Same issue here.  Owner of a small company and trying to turn on the key to migrate to Microsoft Exchange.  When I navigate to the Organization Policies, I get the error message that I'm unable to modify the policy to allow key creation.

[Zorik16]

It looks like your project on Google Cloud has a minus "iam.disableServiceAccountKeyCreation" that prevents the creation of new monitoring service account keys. This may be part of your country's security organization policy. To resolve this issue, you will need to contact your project or organization administrator for more information and permission to create keys.

[balismail]

I think that’s me.  I own the company and set up Google services.

All I’m trying to do is migrate our email from Google to Exchange and this seems way too difficult.

Basheer Alismail
Founder, Monument Health Advisors
<PII removed by staff>
www.monumenthealthadvisors.com
<PII removed by staff>

[Jacobees]

Hi Zorik16,

I am the org admin with super admin rights and I am still unable to modify the permission iam.disableServiceAccountKeyCreation.

I am not that strong in Google workspace but I thought super admin would be the same as an orgadmin that would be able to modify this.

Jake

[DamianS]

Hi @Jacobees ,

---

@Jacobees wrote:

I am not that strong in Google workspace but I thought super admin would be the same as an orgadmin that would be able to modify this.

---

Nope. SuperAdmin is an admin for Google Workspace, so he is able to do anything around Google Workspace. However, Org Admin is a different story and this entity is able to deal only around Google Cloud. In fact, if you are login as SuperAdmin to Google Cloud, you are not automatically became Org Admin. You will get following basic permissions by default , and only via predefined roles you will be able to get more permissions ( yes, if you are login as SuperAdmin, you are able to grant IAM permissions for your own principal at organization level, however as I said, by default you don't more power than showed on this screenshot.)

cheers,
DamianS

[Jacobees]

Hi DamianS,

I am unable to find instructions on how to grant my Super user account Org Admin Permissions to Google cloud so that I have the ability to edit the iam.disableServiceAccountKeyCreation constraint, allowing me to create a JSON key for my migration project.

Would you be able to point me in the right direction, Google documentation, or a Third party how to article?

Cheers

Jake.

[DamianS]

Hello @Jacobees ,

1. Pick your user. I've created user named "test test" for this demo. 
2. Add your newly created user to Super Admin role OR be sure that you user is in that group. Log in to admin.google.com -> Account-> Admin roles -> Super Admin

3. Go to https://console.cloud.google.com and log in with your SUperUser from step1.
4. From left top right corner pick project list and search for your organization

5. Search for IAM -> Grant Access -> Add your SuperUser in "New principals" field. Select either Organization Admin or Organization Policy Administrator to be able to deal with org policies.

6. Click "SAVE"
7. You can verify your changes. Once saved, wait few minutes to be sure that IAM have been properly propagated. 

Add1. You can verify your permissions by using Policy Analyzer -> What access does my employee ( or terminated employee ) have -> Create query -> Put email name for your SuperUser in "Principal" field -> Continue -> Check boxes (

List resources within resource(s) matvhing your query and List permissions inside roles )

cheers,

DamianS

[Jacobees]

Hi Damian S,

Thank you for the  effort you went to providing me with this information. I was able to successfully follow these steps and create the key.

My issue was I had added the Organization Administrator role but did not have the Organization Policy Administrator added.

Cheers,

Jake.

[DamianS]

Hello @Jacobees , 
Great to hear that . 

[Exasperated]

Damian, Thanks so very much for this answer. I am brand new to Google Workspace for nonprofits, and volunteer at that. I had the same problem as Jacobees, and am so glad for your answer. I now have a backup task working.

[DamianS]

Happy to help 🙂 ☮️

[monolithed]

Your instructions saved me. Thanks, kind soul! 

The only issue was that when I set the Org Admin role, I completely lost all permissions. The Owner role saved the day.

I have a very simple task — to get an OAuth token to send emails on behalf of the organization. It seemed like a trivial task, but Google has made it so complicated...

[BBear25]

The policy is enabled in the project when I go to Roles. However, it is not available in the Select Role drop down box. 

[MarkJP]

I have a fix that works for me - hopefully it will work for all.

1. Click the down arrow

2. Select the organization level

3. From the "Burger" menu select [IAM & Admin] > IAM

4. Click [Grant Access]

5. In [New Principals] Enter the account you are currently logged in with

6. In the [Role] select Organization Policy Administrator.

7. In the [Role] selector there is a filter that can be used to make this selection easier.

8. Click [SAVE]

9. Refer to step 1 and switch the focus back to the project you created.

10. From the "Burger" menu select [IAM & Admin] > [Organization policies]

11. From the list of organisational policies select [ Disable service account key creation] - this is on the 2nd page of policies.

12. On the policy page click [Manage Policy]

13. Select [Override] parent's policy]

14. Add a rule and set enforcement off

15. Click [Set Policy]

16. Logout and back in to the developer console

I was then able to continue to continue to create the Service account keys

[Jacobees]

Hi MarkJP,

Can Confirm the same steps also worked for me. Glad you got this across the line as well.

Jake.

[roughnut]

Champion effort! After trying to work this out for hours, your post got it going in 10 mins. Cheers.

[riyoutku]

Hello,

I am unable to find "Organization Policy Administrator" role 

[DamianS]

@riyoutku ,
This policy can be assigned ONLY at organization level. You are showing project level on the screenshot, and this is why you are not able to see mentioned policy

--
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

[cristiane]

Hello, 

Can you help me by telling me if this solution still works after June 16?

Thanks,

[DamianS]

Hello @cristiane  ,Welcome on Google Cloud Community.

Yes, this solution still works. Additionally look at this medium.com article, which tries explain deeper this case: https://medium.com/google-cloud/troubleshooting-101-solving-the-service-account-key-creation-is-disa...

--
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

[yew]

I managed to follow this thread and solve the same issue. 
Thanks Damian for a lot of the answers and all the folks pressing on the same issue / question alot of us face.

Key learning: Enable permission as Organisation Policy Administrator is in the Organisation level (and only here)

[CrucialTech]

Hello, thanks for this info all, as it was very helpful. However, I am still unable to create a service key for migration to MS.

I was successful in granting my super admin user the Organizational Policy Administrator:

I was also successful, it seems, in overriding the "Disable service account key creation", so it is not enforced (this at org level).

At the project level, I have the exact same as above (although I have also tried leaving it to inherit parent, and it too is the same). So it seems it is NOT ENFORCED. However, still when I try to add the service key, it is denied. Does anyone have any suggestions? Thank you

[bookofiris]

I'm running into this issue, where I follow the instructions above (and in other forums), but the problem persists. I keep getting a message that the policy constraint is enforced even though I changed the policy to "Not Enforced" at the organization level.

Please let me know if you were able to find a solution.

[CrucialTech]

Update: I noticed that I had 2 policies for "Disable service account key creation". One was managed and the other was not. I did not noticed the second non-managed one, but once I did and I changed it to override parent, it worked.

[treatteam]

THIS FIXED THE ISSUE FOR ME TWO. both need to be turned off. terrible ux

[titocosta]

After dealing with the whole SuperAdmin and Organization Policy Admin bullshit (even if I am the owner and just registered the Workspace account), I had the same problem.

There are two of these "Disable service account key creation policies" and one named "legacy" was active! Unbelievably bad and retarded design by Google.

I still couldn't create a service account key from the firebase console, but I could from https://console.cloud.google.com/iam-admin/serviceaccounts/

[TobyEllis]

I as able to add myself as Organization Policy Admin and in the Console under the project run this to disable the policy and create the JSON key:

gcloud org-policies delete iam.disableServiceAccountKeyCreation --organization=<organizaitonID#>

I am using MigrationWiz to migrate email to 365. I hope this helps the next person.

thanks for all the info above!