Allow GUBUS service-account credentials

Prepare a Google Cloud project when an inherited organization policy blocks service-account JSON keys.

What this setting controls

GUBUS creates a service account in the Google Cloud project you select, creates one JSON credential for it, and stores that credential in your reusable GUBUS runtime pool. Google Cloud can block the credential step with the legacy organization policy:

constraints/iam.disableServiceAccountKeyCreation

When that policy is active, Google can create the service-account identity but cannot return the JSON credential GUBUS needs. GUBUS checks the effective policy before creating anything and stops the operation when the project is blocked.

The policy belongs to the Google Cloud project hierarchy. It is not a setting on your Gmail account. A project can inherit it from a folder or organization even when you never enabled it on the project yourself.

Prepare the selected project

  1. In the developer dashboard, open My Google Cloud.
  2. Choose the Google Cloud project that will contain your GUBUS service accounts.
  3. If GUBUS reports Google Cloud setup required, click Open required Google Cloud setting. The link opens the exact project and policy through Google’s account chooser.
  4. In Google Cloud, confirm both the signed-in Google account and the selected project.
  5. Open the active Disable service account key creation row with ID iam.disableServiceAccountKeyCreation.
  6. Click Manage policy.
  7. Select Override parent’s policy.
  8. Set Enforcement to Off, then save the policy.
  9. Return to GUBUS and click Check again.

The readiness panel should change to Google Cloud ready. Service-account creation is then enabled.

If you cannot manage the policy

Google Cloud’s Project Owner and Editor roles do not include the permission needed to change organization policies. If Manage policy is missing or disabled, ask the Google Cloud organization administrator to do one of the following:

  • turn off iam.disableServiceAccountKeyCreation for this project;
  • exempt this project from the inherited policy; or
  • grant the appropriate Organization Policy Administrator access.

You can alternatively select another Google Cloud project where service-account key creation is already allowed.

How to recognize the problem

The relevant policy page normally shows two similarly named constraints. GUBUS currently checks the legacy constraint that produces this Google error:

Key creation is not allowed on this service account.

Look for the row whose ID is iam.disableServiceAccountKeyCreation. If its enforcement state is Active and its policy source says Inherit parent’s policy, override it for the selected project as described above.

Security boundary

Only disable this constraint for a project you intentionally use as a GUBUS service-account container. GUBUS reads the effective policy but does not request permission to modify organization policies on your behalf.

For Google’s explanation of the constraint and required administrative role, see Troubleshoot organization policy errors for service accounts and Create and delete service-account keys.