How can I create a GCP service account with assigned role that will only be valid for a certain period of time?

Question

I'm trying to create a service account on GCP, then assigning a role that's only valid for 24 hours. What would be the best way to do it?

I'm trying to follow the instruction from the following article, but it sounds like the max is 1 one hour? How can I set it for 24 hours?

https://cloud.google.com/iam/docs/create-short-lived-credentials-direct

Answer 1

In your use case, I recommend you to use IAM Condition on your service account. The IAM condition is an aspect that you add on the account-role binding. You can add different conditions, especially a time condition.

After a delay, the condition will no longer meet and the role won't be considered as valid when checked. So, the permissions can be considered as removed.

You can have expiration on an identity (ie on the service account) only on the roles that are bound with that identity