Service Account Key Expiration: Transition from Indefinite Lifetime to Enforced Limits

Goal: assess whether existing service account keys that lack an explicit expiration date will be automatically treated as expired once an organization policy enforces a maximum key lifetime, and understand the impact on workloads that continue to use downloadable keys versus those migrated to Workload Identity Federation.

Constraints include the version‑sensitive nature of the policy enforcement, variability in how different Google Cloud APIs treat expired keys, and the fact that expired credentials are not purged from external systems, which can produce runtime failures that resemble permission denials.

Specific questions: Will keys without a set expiration date be rejected at authentication time after the policy takes effect? How do various APIs (e.g., Compute Engine, Cloud Storage, BigQuery) differentiate between an expired key and a lack of sufficient IAM permissions? What observable signals can administrators rely on to distinguish key‑expiry failures from other auth errors during a phased rollout?