We are encountering an urgent issue with uploading public keys to service accounts in Google Cloud Platform. When we upload a public key to a newly created service account, it is incorrectly labeled as “Google managed” (with the Google icon on the left) instead of “Uploaded” (arrow-up icon). This is…

Hello @leoezhil Thanks for sharing your question in the Apigee community. First, let’s mention that GOOGLE_MANAGED keys cannot be downloaded, and are automatically rotated. They’re not visible in the Cloud console, but will show up in the output of “gcloud iam service-accounts keys list” command.…

Thank you, Hilda, for your response. Let me take a stab at explaining the issue again. We can upload the user-generated public keys to our service accounts, so the constraints and permissions are good. In our older service accounts, the “keyOrigin” would appear as “USER_PROVIDED” when we upload the…

We can confirm this bug/behavior as well and it is impacting operations.

Hi @leoezhil thanks for providing more details and screens. I’m double checking this, once I have further information myself or someone from Google Apigee’s team will jump in with more details. Apologies for the delay or the issues this may cause Thanks @Cdillard noted and checking

This is impacting workload migrations into GCP. Prompt remediation would be greatly appreciated.

@Hilda_Arteaga . Ty. We have also opened a high impact support case for the same scenario. Case # 52686529. You can check with Google support team as well.

We also have case Google support case 52685694 opened as well.

Issue with user managed GCP public key for Service Account - treaded as Google managed instead

Google Cloud Compute Infrastructure

leoezhil August 13, 2024, 1:05pm 9

Google cloud product and engineering team has acknowledged this issue and released a fix. We have verified the fix so closing this issue as solved.

Topic		Replies	Views
Understanding Service Account Key and IAM Permission Updates Compute Infrastructure compute-engine , infrastructure-general , vm-manager	2	138	March 7, 2025
Service Account Managed vs. Unmanaged Keys – How Does GCP Differentiate Them? Compute Infrastructure infrastructure-general	2	22	March 25, 2025
Subject: Unable to Create Service Account Keys Due to Enforced Policy: constraints/iam.disableServic Compute Infrastructure workload-manager , infrastructure-general , cloud-storage	2	107	February 13, 2025

Issue with user managed GCP public key for Service Account - treaded as Google managed instead

AI Suggested topics