From https://console.cloud.google.com/iam-admin/serviceaccounts?project=[id], a user with the right permissions can provision a service account key. Nowadays, they hand it to you in JSON format, but they used to give you the option to receive a P12 (of which the JSON is just the P12 base64'd, with metadata). I have inherited an older project to maintain, and I have a P12 to authenticate with.
However, there are multiple key IDs listed for the given service account. I'd like to rotate them all out and delete everything except for a newly provisioned key. I can't create a new one, because the max is already reached (10). But I can't delete at random, because the application still needs to run unhindered. Only one is needed, and short of roulette, I can't figure out a way to determine WHICH key I have.
I am able to authenticate:
[~/scratch]$ gcloud auth activate-service-account firstname.lastname@example.org --key-file=x.p12 --prompt-for-password Password: WARNING: .p12 service account keys are not recomended unless it is necessary for backwards compatability. Please switch to a newer .json service account key for this account. Activated service account credentials for: [email@example.com]
and then run commands. But I can't find a way, either through Gcloud, or trickery, to get Google to tell me WHICH key I have. I've tried a bunch of gcloud commands. Is there anything in GCP logging, straight API calls, undocumented commands, or something obvious I've missed?