Service account impersonation, short-lived credentials and avoiding service account keys

A service account key is a long-lived private key file (JSON) that anyone can use to authenticate as the service account, from anywhere, until the key is deleted or disabled. Keys are one of the most common causes of cloud breaches because they get copied into source code, laptops, CI systems and chat messages. Google's guidance is to avoid creating keys whenever another option exists, and many organizations block key creation with the iam.disableServiceAccountKeyCreation organization policy.