Cannot create Service Account Key - iam.disableServiceAccountKeyCreation Organization Policy blocking Vertex AI Search integration

Google Cloud Build with AI Generative AI & Foundational Models
1

Hi Google Cloud Community,

I am facing an issue where I cannot create a Service Account key
for my project due to an enforced Organization Policy.

Error: “Service account key creation is disabled”
Policy: iam.disableServiceAccountKeyCreation

Environment Details:

  • Organization: strategicpointanalytics-org
  • Organization ID: (PII Removed by Staff)
  • Project ID: (PII Removed by Staff)
  • Tracking Number: (PII Removed by Staff)

Use Case:
I am integrating Vertex AI Search with a WordPress website
hosted on Kinsta. The plugin (JRCMO Vertex AI Search) requires
a Google Cloud Access Token for authentication.

Current Problem:
The access token expires every ~1 hour and needs to be manually
refreshed each time from Google Cloud Shell using:
gcloud auth print-access-token

This is not a sustainable solution. I want to use a Service
Account JSON key in PHP code to auto-refresh the token
programmatically - but the Organization Policy is blocking
Service Account key creation.

What I Have Tried:

  1. Tried creating Service Account key - blocked by org policy
  2. Tried running: gcloud org-policies delete
    iam.disableServiceAccountKeyCreation
    –organization=(PII Removed by Staff)
    Got PERMISSION_DENIED error

Questions:

  1. How can I disable this policy as the project owner?
  2. Is there an alternative authentication method for Vertex AI
    Search that works without a Service Account key?
  3. Can I use OAuth 2.0 or any other method in PHP to
    auto-refresh the token?

Any help would be greatly appreciated!

Thanks

2

This looks like an Organization-level restriction. You’ll likely need help from the Org Admin to disable it or use another auth method like OAuth 2.0.