Enable Service Account Key Creation in Google Cloud Console
Step 1 — Check for Blocking Policies
In Google Cloud Console, switch to your project.
Go to IAM & Admin → Organization policies.
Search for Disable service account key creation.
If two entries appear (one with .managed and one without), note their enforcement status.
Step 2 — Get Required Permissions
Ask an administrator to grant you Organization Policy Administrator (roles/orgpolicy.policyAdmin) or Organization Administrator (roles/resourcemanager.organizationAdmin) at the organization level.
Ensure you also have Service Account Admin (roles/iam.serviceAccountAdmin) or Editor (roles/editor) at the project level.
Step 3 — Override the Managed Constraint
In Organization policies, search for iam.managed.disableServiceAccountKeyCreation.
Click it, then select Manage policy.
Choose Override parent’s policy and set Enforcement to Off.
Click Save.
Step 4 — Override the Legacy Constraint
Search for iam.disableServiceAccountKeyCreation in Organization policies.
Click it, then select Manage policy.
Choose Override parent’s policy and set Enforcement to Off.
Click Save.
Service Account Keys may now be created, if you were following instructions elsewhere you can resume those instructions.
Step 5 — Create a Service Account Key
Go to IAM & Admin → Service accounts.
Open your service account and go to the Keys tab.
Click Add key → Create new key → JSON.
Download and store the key securely.
Step 6 — Security Best Practices
Never commit JSON keys to public repositories.
Store keys in a secure secret manager.
Rotate or delete unused keys regularly.