Service accounts, keys, and impersonation

Speaker notes

• A service account is simultaneously a principal (it can be granted roles) and a resource (IAM policies attach to it, controlling who can act as it) — granting the service account a role and granting a human roles/iam.serviceAccountUser on it are two completely separate bindings.
• A service account key is a downloadable JSON file that authenticates indefinitely from anywhere until explicitly revoked — no built-in expiration, fully portable if leaked, and invisible misuse looks identical to legitimate use. Treat any committed key as compromised immediately, not just deleted from the commit.
• Impersonation is the default for any human occasionally needing to act as a service account: a short-lived token (one hour default) generated on demand, every event logged in Cloud Audit Logs — strictly better security posture than a key file, with zero legitimate human use case a key file covers that impersonation doesn't.

Deck map