Ask HN: Why would I want to disable exposed key protection in Google Cloud?
We’re writing to remind you that Google Cloud is introducing an organizational policy change on June 16, 2024. This change allows organization administrators to define how Google Cloud should respond if we become aware that a private Service Account Key has been publicly exposed. We are integrated with several programs, including the GitHub scanning program, to identify publicly exposed private Service Account Keys.
What you need to know
Service account keys must be kept private, and exposing them publicly can compromise your Google Cloud environment. A compromised Service Account Key could be used by bad actors to access, modify, or delete your data and/or consume expensive resources. We understand this could be disruptive to your organization and we are taking proactive measures to protect your environment.
To enhance the security of your environment, this organizational policy change will take effect on June 16, 2024. This change will proactively disable any publicly exposed Service Account Keys that we become aware of. This will affect all uses of the exposed Service Account Key.
What you need to do
You have the ability to modify this behavior ahead of time by taking one of the following actions:
Opt-in early by setting the IAM.serviceAccountKeyExposureResponse constraint to DISABLE_KEY which will enable the protection immediately. Opt-out anytime by setting the IAM.serviceAccountKeyExposureResponse constraint to WAIT_FOR_ABUSE which will disable the protection. Do nothing, in which case Google will enable the protection on your behalf on June 16, 2024. Again, we understand that these changes might require some planning, but they are designed to enhance security for your environment, which remains a top priority at Google.
Thank you for choosing Google Cloud.
---
From the email they sent out.