Key Takeaways

• Google KeyJSON refers to the JSON-formatted private key files exported from Google Cloud IAM for service account authentication — it is not a proprietary Google product or format beyond standard service account key files.
• Each KeyJSON file contains a private key, client email, project ID, and certificate URL that grants programmatic access to Google Cloud services on behalf of a service account.
• Never commit KeyJSON files to version control. Use environment variables, secret managers, or mounted volumes to inject credentials at runtime.
• Rotate keys every 90 days and disable old keys immediately after new ones are verified working — this is the single most effective credential rotation practice.
• Principle of least privilege applies: create dedicated service accounts per workload instead of using the default Compute Engine service account.

What Is Google KeyJSON?

Google KeyJSON is the informal term used by developers and DevOps engineers to describe the JSON key file that Google Cloud generates when you create a service account key. These files are the primary mechanism for authenticating workloads — containers, servers, CI/CD pipelines, and local development environments — to Google Cloud services without interactive user login.

The file contains the service account's cryptographically signed private key alongside metadata that Google client libraries use to construct OAuth 2.0 or JWT-based authentication assertions.

What's Inside a KeyJSON File

The private_key field is the most sensitive component. Anyone with access to this key can impersonate the service account and act with whatever permissions that account holds.

How to Create a Google KeyJSON File

Follow this step-by-step process to generate a service account key in JSON format via the Google Cloud Console or the CLI.

Method 1: Google Cloud Console (GUI)

• Open the GCP Console and navigate to IAM & Admin → Service Accounts.
• Select the target service account or click Create Service Account.
• Assign the required roles (e.g., Storage Object Admin, Cloud SQL Client) — only grant what is necessary.
• Click Details → Add Key → Create new key.
• Choose JSON as the key type and click Create.
• Download the file immediately — it is only available once after creation.

Method 2: gcloud CLI

gcloud iam service-accounts create my-sa \
  --display-name="My Service Account"

gcloud iam service-accounts keys create key.json \
  --iam-account=my-sa@my-project.iam.gserviceaccount.com

Method 3: Terraform / Infrastructure as Code

resource "google_service_account" "my_sa" {
  account_id   = "my-sa"
  display_name = "My Service Account"
}

resource "google_service_account_key" "my_sa_key" {
  service_account_id = google_service_account.my_sa.id
  valid_for_seconds  = 31536000  # 1 year max
}

Important: Terraform stores the private key in state. Ensure your state file is encrypted at rest and access is restricted.

Security Best Practices for Google KeyJSON

Service account keyJSON files are high-value targets. Compromised keys can lead to full account takeover, data exfiltration, or cryptocurrency mining at your expense. Follow this playbook rigorously.

Do This

• Use Google Secret Manager to store and retrieve keys at runtime instead of persistent files on disk.
• Enable VPC Service Controls to create security perimeters around your service account keys.
• Audit key usage via Cloud Audit Logs — filter for iam.googleapis.com activity by privateKey_id.
• Set expiration on keys where possible (maximum 1 year enforced by Google).
• Use Workload Identity on GKE to bind Kubernetes service accounts to GCP service accounts — eliminates keyJSON entirely.

Never Do This

• Never hardcode a KeyJSON path or contents in application source code.
• Never commit a .json key file to Git, Docker images, or artifact repositories.
• Never share a KeyJSON file via email, Slack, or unencrypted channels.
• Never use the default Compute Engine service account (...@project.iam.gserviceaccount.com) with broad roles.