DET-C10: Long-lived key created on the workload service account¶
A user-managed service-account key was created on the workload identity. A static key authenticates with no attestation at all, so it bypasses the workload identity pool and the whole Confidential Space gate.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | GCP Confidential Space |
| Group | tee |
| Log source | Cloud Audit Logs · IAM |
| Policy | P-03 |
| Related check | CSPACE-SA-01: Workload SA cannot be impersonated to bypass attestation |
Fires when¶
CreateServiceAccountKey AND serviceAccount == the workload service account
How it runs¶
untrust detect --platform sev-snp reads the project's Cloud Audit Logs over the last --since minutes (default 60).
This rule needs:
untrust detect --gcp-service-account: Workload service account email the pool impersonates (DET-C10).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.