Node.js: gcloud – Rotating Service Account Keys Before They Expire

gcloud iam workload-identity-pools create github \
  --project=my-project --location=global --display-name="GitHub Actions"

gcloud iam workload-identity-pools providers create-oidc my-org \
  --project=my-project --location=global --workload-identity-pool=github \
  --issuer-uri="https://token.actions.githubusercontent.com/" \
  --attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
  --attribute-condition="assertion.repository_owner=='my-org'"

gcloud iam service-accounts add-iam-policy-binding deployer@my-project.iam.gserviceaccount.com \
  --role=roles/iam.workloadIdentityUser \
  --member="principalSet://iam.googleapis.com/projects/123456789012/locations/global/workloadIdentityPools/github/attribute.repository/my-org/my-repo"

node rotate-sa-keys.js --project my-project \
  --service-account reporting@my-project.iam.gserviceaccount.com \
  --max-age-days 90 --dry-run

node rotate-sa-keys.js --project my-project \
  --service-account reporting@my-project.iam.gserviceaccount.com \
  --max-age-days 90 --secret sa-reporting-key

Found 3 user-managed key(s) on reporting@my-project.iam.gserviceaccount.com
Key 3f9a1c2b... is 142 days old, exceeds 90-day threshold
Key 77d0e4aa... is already disabled (SERVICE_ACCOUNT_KEY_DISABLE_REASON_USER_INITIATED)
Key ef567890... is 12 days old, within threshold
Created key 0b1c2d3e..., stored in Secret Manager version projects/123456789012/secrets/sa-reporting-key/versions/4
Old key(s) left enabled. Deploy the new key, then rerun with --disable-old.

gcloud secrets versions access latest --secret=sa-reporting-key --project=my-project > new-key.json

node rotate-sa-keys.js --project my-project \
  --service-account reporting@my-project.iam.gserviceaccount.com \
  --max-age-days 90 --disable-old

Found 4 user-managed key(s) on reporting@my-project.iam.gserviceaccount.com
Key 3f9a1c2b... is 142 days old, exceeds 90-day threshold
Key 77d0e4aa... is already disabled (SERVICE_ACCOUNT_KEY_DISABLE_REASON_USER_INITIATED)
Key ef567890... is 13 days old, within threshold
Key 0b1c2d3e... is 1 days old, within threshold
Disabled old key 3f9a1c2b...

#!/usr/bin/env node
/**
 * rotate-sa-keys.js
 *
 * Finds user-managed Google Cloud service account keys older than a threshold
 * and creates one replacement key. After the replacement is deployed, a second
 * run with --disable-old disables (not deletes) the old ones so anything still
 * depending on them fails loudly and can be rolled back.
 *
 * Reads:  service account key metadata via the IAM API (iam.googleapis.com).
 * Writes: the new key either as a new Secret Manager version (--secret) or to
 *         a local file with mode 0600 (--output); with --disable-old, disables
 *         old keys in place.
 *
 * Usage:
 *   node rotate-sa-keys.js --project <project-id> \
 *     --service-account <sa>@<project-id>.iam.gserviceaccount.com \
 *     --max-age-days 90 (--secret <secret-id> | --output ./new-key.json | --disable-old) [--dry-run]
 */

const fs = require('fs');
const { google } = require('googleapis');

const MAX_KEYS_PER_ACCOUNT = 10;
const DAY_MS = 24 * 60 * 60 * 1000;

function parseArgs(argv) {
    const args = {
        project: null,
        serviceAccount: null,
        maxAgeDays: 90,
        output: null,
        secret: null,
        disableOld: false,
        dryRun: false,
    };

    for (let i = 0; i < argv.length; i += 1) {
        switch (argv[i]) {
            case '--project':
                args.project = argv[++i];
                break;
            case '--service-account':
                args.serviceAccount = argv[++i];
                break;
            case '--max-age-days':
                args.maxAgeDays = Number(argv[++i]);
                break;
            case '--output':
                args.output = argv[++i];
                break;
            case '--secret':
                args.secret = argv[++i];
                break;
            case '--disable-old':
                args.disableOld = true;
                break;
            case '--dry-run':
                args.dryRun = true;
                break;
            default:
                throw new Error(`Unknown argument: ${argv[i]}`);
        }
    }

    if (!args.project || !args.serviceAccount) {
        throw new Error('--project and --service-account are required');
    }
    if (!Number.isFinite(args.maxAgeDays) || args.maxAgeDays < 1) {
        throw new Error('--max-age-days must be a positive number');
    }
    if (args.disableOld && (args.output || args.secret)) {
        throw new Error('--disable-old creates no key; drop --secret/--output');
    }
    if (!args.dryRun && !args.disableOld && !args.output === !args.secret) {
        throw new Error('Specify exactly one of --secret or --output');
    }

    return args;
}

function ageInDays(validAfterTime) {
    return Math.floor((Date.now() - new Date(validAfterTime).getTime()) / DAY_MS);
}

async function storeKey(args, auth, privateKeyData) {
    if (args.secret) {
        // privateKeyData is already base64, which is what SecretPayload.data expects.
        const secretManager = google.secretmanager({ version: 'v1', auth });
        const { data } = await secretManager.projects.secrets.addVersion({
            parent: `projects/${args.project}/secrets/${args.secret}`,
            requestBody: { payload: { data: privateKeyData } },
        });
        return `Secret Manager version ${data.name}`;
    }

    const json = Buffer.from(privateKeyData, 'base64').toString('utf8');
    const fd = fs.openSync(args.output, 'w', 0o600);
    try {
        fs.fchmodSync(fd, 0o600); // open's mode only applies when it creates the file
        fs.writeSync(fd, json);
    } finally {
        fs.closeSync(fd);
    }
    return args.output;
}

async function main() {
    const args = parseArgs(process.argv.slice(2));
    const auth = new google.auth.GoogleAuth({
        scopes: ['https://www.googleapis.com/auth/cloud-platform'],
    });
    const iam = google.iam({ version: 'v1', auth });
    const accountName = `projects/${args.project}/serviceAccounts/${args.serviceAccount}`;

    const { data } = await iam.projects.serviceAccounts.keys.list({
        name: accountName,
        keyTypes: ['USER_MANAGED'],
    });
    const keys = data.keys || [];
    console.log(`Found ${keys.length} user-managed key(s) on ${args.serviceAccount}`);

    const expired = [];
    let current = 0;
    for (const key of keys) {
        const keyId = key.name.split('/').pop();
        const days = ageInDays(key.validAfterTime);
        const expiry = key.validBeforeTime && !key.validBeforeTime.startsWith('9999')
            ? `, expires ${key.validBeforeTime}`
            : '';

        if (key.disabled) {
            console.log(`Key ${keyId.slice(0, 8)}... is already disabled (${key.disableReason || 'no reason'})`);
        } else if (days > args.maxAgeDays) {
            console.log(`Key ${keyId.slice(0, 8)}... is ${days} days old${expiry}, exceeds ${args.maxAgeDays}-day threshold`);
            expired.push(key);
        } else {
            console.log(`Key ${keyId.slice(0, 8)}... is ${days} days old${expiry}, within threshold`);
            current += 1;
        }
    }

    if (expired.length === 0) {
        console.log('No keys required rotation.');
        return;
    }

    if (args.disableOld) {
        if (current === 0) {
            throw new Error('No enabled key within the threshold; run without --disable-old to create one first');
        }
        if (args.dryRun) {
            console.log(`Dry run: would disable ${expired.length} key(s).`);
            return;
        }
        for (const key of expired) {
            await iam.projects.serviceAccounts.keys.disable({ name: key.name });
            console.log(`Disabled old key ${key.name.split('/').pop().slice(0, 8)}...`);
        }
        return;
    }

    if (keys.length >= MAX_KEYS_PER_ACCOUNT) {
        throw new Error(`Account already has ${keys.length} keys (limit ${MAX_KEYS_PER_ACCOUNT}); delete disabled keys first`);
    }
    if (args.dryRun) {
        console.log('Dry run: would create 1 replacement key.');
        return;
    }

    const created = await iam.projects.serviceAccounts.keys.create({
        name: accountName,
        requestBody: { privateKeyType: 'TYPE_GOOGLE_CREDENTIALS_FILE' },
    });
    const newKeyId = created.data.name.split('/').pop();
    const location = await storeKey(args, auth, created.data.privateKeyData);
    console.log(`Created key ${newKeyId.slice(0, 8)}..., stored in ${location}`);
    console.log('Old key(s) left enabled. Deploy the new key, then rerun with --disable-old.');
}

main().catch((error) => {
    console.error(error.message);
    process.exitCode = 1;
});