[ACCOUNT_KEYS_POLICY] Action Required: Service Account Policy Drift

Open

#39,931 opened on Aug 31, 2026 0 comments 0 reactions 0 assignees View on GitHub

Dominant language: Java
Stars: 8.7k
Forks: 4.7k
Avg merge: 1d 20h
Merged PRs (30d): 196

Description

### Compliance Audit Report (2026-09-14 09:15:39 UTC)
Service Account Policy Drift Report

Account keys for project apache-beam-testing are not compliant with the defined policies on ../keys/keys.yaml

- Service account 'github-self-hosted-runners@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-uzgihx18zf-1@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'secrets-manager@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'dannymccormick-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'riteshghorse@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'ahmedabualsaud@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'ml-pipelines-google-vision@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'danoliveira-release@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'prod-playground-sa-cf@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-storage@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-wheels-travis@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'bigquery-admin@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'allows-impersonation-new@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-metrics-posgresql-kube@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'da-pipelines@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'johnjcasey-gha-service-account@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'firebase-adminsdk-dpfsw@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'apache-beam-testing@appspot.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'rrio-tests-63de9ae8@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'prod-playground-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'valentyn-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'rehman@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'bhulette-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'pground-skey@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-wheels-github@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'travis-ci-access-to-storage@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'svetaksundhar-233@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'stg-playground-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'dataflow-ml-starter@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'chamikara-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'yathu-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'apache-beam-testing-miguelaz@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'zyichi-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'apache-beam-testing-ml6@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'boyuanz@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'playground-deploy-cb@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'apache-beam-testing-klk@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'self-hosted-runners@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'apache-beam-testing-mikehdz@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'stg-tourofbeam-cb-deploy@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'bigquery-reader@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tourofbeam-stg3-cloudfunc-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-github-actions-k8-nodes@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'stg-tourofbeam-cb-cd@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'rrio-2hag2q@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'syndeo-test-account@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'vitaly-terentyev@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-github-actions@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'safe-viewer@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'playground-cd-cb@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'gh-workflow-prefetcher-dev@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'playground-update-cb@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'venturedive-beamers@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'allows-impersonation@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'gke-github-actions-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'anandinguva@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tourofbeam-cf-sa-prod@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'fuyuwei@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'kcweaver-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tourofbeam-cb-ci-prod@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'playground-ci-cb@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'infra-pipelines-worker@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'vdjerek-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-testing-dmartin-api-token@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'lostluck@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'andreydevyatkin-runner-gke-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'wasmx-jbdthx@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tourofbeam-cf-sa-stg@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'playground-deploy-vladm@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'jrmccluskey@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tourofbeam-cb-cd-prod@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tourofbeam-cb-deploy-prod@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'stg-tourofbeam-cb-ci@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'ayush-pandey@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-ai@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'impersonation-dataflow-worker@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account '844138762903-compute@developer.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'gh-workflow-prefetcher-invoker@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'secrets-manager-40@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'mock-apis-64xjw9@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'beam-storage-935@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'adudko-runner-gke-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'apache-beam-testing-chamikara@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'eventarc-workflow-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-uzgihx18zf-0@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'bhulette-it-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'emilyye@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'stg-playground-sa-cf@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'yiru-beam-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-odmv2iiu6v-0@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'valentyn-dataflow-deployer@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-saufixtb2cef@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'auth-example@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-odmv2iiu6v-1@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-mzqkfah3bm-0@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-ntgfw3y4q6-0@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-egyosq0h66-1@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-ntgfw3y4q6-1@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-mzqkfah3bm-1@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-egyosq0h66-0@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-wb0saeyob0-0@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tf-test-dataflow-wb0saeyob0-1@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'shunping-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tarun-dataflow-custom-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'akarys-shorabek@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'charlesnguyen@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'ratelimit-actuation-sa-1@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'aleks-vm-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'aibrahiim@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'actuation-a@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tarun-926@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'tarun-local-test@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'ratelimit-actuation-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.
- Service account 'A1K28-github-arc-sa@apache-beam-testing.iam.gserviceaccount.com' is not declared in the service account keys file.

### History

Click to expand

### Compliance Audit Report (2026-09-07 09:15:58 UTC)
Service Account Policy Drift Report

Account keys for project apache-beam-testing are not compliant with the defined policies on ../keys/keys.yaml

---

### Compliance Audit Report (2026-08-31 09:16:19 UTC)
Service Account Policy Drift Report

Account keys for project apache-beam-testing are not compliant with the defined policies on ../keys/keys.yaml

Contributor guide

Open the contributing guide

Research direction

Start with ../keys/keys.yaml and the compliance audit report to understand how service accounts are declared and which reported accounts require review. The report is truncated, so obtain the complete account list before making changes; done means the retained accounts comply with the defined policy and the audit reports no drift.

Written by the indexing model from the issue text.

Assessment

Tech stack: gcp
Domain: cloud, security
Issue type: Bug
Difficulty: 4/5
Estimated time: 3-5 days
Activity status: Active
Clarity: Needs clarification
Newbie friendliness: 35/100

[ACCOUNT_KEYS_POLICY] Action Required: Service Account Policy Drift

Description

Contributor guide

Research direction

Assessment

Get new issues in your inbox