Key creation is not allowed on this service account Google Cloud / Firebase Origin: Platform & cloud OSI layer 7 · Application Last updated 4 Nov 2026

GCP: FAILED_PRECONDITION: Key creation is not allowed on this service account (constraints/iam.disableServiceAccountKeyCreation)

An organisation policy forbids creating downloadable JSON keys for service accounts.

Exact message you may see Key creation is not allowed on this service accountFAILED_PRECONDITION: Key creation is not allowed on this service accountiam.disableServiceAccountKeyCreation organization policy
Explore the map of this error Full error map →
Seen on: Google Cloud

Meaning

New organisations enforce iam.disableServiceAccountKeyCreation by default. Prefer keyless options: Workload Identity (GKE), Workload Identity Federation (GitHub Actions/AWS), attached service accounts (Cloud Run, GCE) or impersonation. If keys are unavoidable, an Org Policy Administrator must relax the constraint for that project.

Common causes

  • Constraint iam.disableServiceAccountKeyCreation enforced
  • Secure-by-default organisation policies
  • Trying to use keys from CI
  • Project inherits org-level policy
  • Missing org-policy admin rights to change it

⚡ Quick fix

  1. Use Workload Identity Federation for CI instead of keys
  2. Attach a service account to the runtime
  3. Request a policy exception from an org admin

Detailed fix by platform

gcloud

  1. gcloud resource-manager org-policies describe iam.disableServiceAccountKeyCreation --project PROJECT

How to diagnose

  1. Policy — Constraint enforced?
  2. Alternative — Keyless possible?
  3. Admin — Can change the policy?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

403: does not have storage.objects.get access — Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object (Google Cloud / Firebase)403: does not have st…BigQuery: Access Denied: Project: User does not have bigquery.jobs.create permission — BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project (Google Cloud / Firebase)BigQuery: Access Deni…Cloud Run 403: Your client does not have permission to get URL — Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server (Google Cloud / Firebase)Cloud Run 403: Your c…Could not load the default credentials — Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started (Google Cloud / Firebase)Could not load the de…Error 403: API has not been used in project (Terraform) — Terraform: Error: Error creating Network: googleapi: Error 403: Compute Engine API has not been used in project 123 before or it is disabled (Terraform)Error 403: API has no…Google provider: could not find default credentials — Terraform: Error: Attempted to load application default credentials since neither `credentials` nor `access_token` was set in the provider block. No credentials loaded (Terraform)Google provider: coul…Organization policy constraint violated — Google Cloud: Constraint constraints/compute.vmExternalIpAccess violated for project — Request violates constraint 'constraints/...' (Google Cloud / Firebase)Organization policy c…PERMISSION_DENIED: Permission 'x' denied on resource — Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist) (Google Cloud / Firebase)PERMISSION_DENIED: Pe…Key creat…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.