Restrict access to service accounts

[mharitakis]

Hello team,

is there a way a specific service account not to be modified or deleted from other principals?

can this configured by an organizational policy?

Thanks

[FrancoGP]

Hey!
To achieve this basic roles like owner or editor should be avoided as well as the roles/iam.serviceAccountAdmin. There is no constraint that locks the resource on it's own (there is for no key creation or service account creation blockage, form example) 

Taking this in to account iam management should be in order and just grant enough accesses.