Service account key creation disabled: check organization policy first

Problem

A user has IAM permissions but still cannot create a service account key.

Why it happens

GCP organization policy can disable service account key creation across folders or projects. Project-level IAM alone does not override that policy, so the failure can look confusing if you only inspect the project.

Fix / Approach

Check organization policy first, then decide whether an exception is justified or whether a safer keyless approach should be used instead.

Command / Config

Things to check:

• `iam.disableServiceAccountKeyCreation`
• Organization policy inheritance
• Folder or project policy status
• Service account permissions
• Workload Identity or instance service account alternatives

When to use

• GCP environments with centralized security policies
• Compliance-constrained projects
• Organizations that restrict long-lived keys

When not to use

• Projects where service account key creation is intentionally allowed and the issue is only missing IAM permission

Common mistakes

• Debugging only at the project IAM layer
• Requesting broad exceptions before checking inherited policy
• Creating keys by habit when a keyless pattern is available