When one does "gcloud auth login", the credentials are stored on the local system.

Is there a way to set a policy on an organisation in GCP that will ensure all credentials will be time-limited, so that users need to reauthenticate regularly?

My main concern is that these credential files may fall into the wrong hands, i.e. if a developer's laptop is stolen, or a roommate may access a developer's laptop. Time limiting the validity of these tokens will limit the damage somewhat.

I know users can do "gcloud auth revoke", or go to https://myaccount.google.com/permissions an revoke Google Cloud SDK permissions there, but both are manual processes.


It does not seem possible at the moment within Google Cloud Platform. I suggest submitting a feature request about it by following this guide. It could be possible through G suite and per this article.

However, one way to go around this, and while the user changes his Google account sign-in password in case if the laptop was stolen, is to revoke Google Cloud SDK’s access (to the account) as indicated in this document.

"sign-in & security" > "Manage Apps" > "Google Cloud SDK"

Thus, the tokens will not work anymore, and a token refresh will fail throwing an error similar to this:

ERROR: (gcloud.compute.instances.list) There was a problem refreshing your current auth tokens: invalid_grant: Token has been expired or revoked.
Please run:

  $ gcloud auth login

This should remain the case (for the intruder) even after the (legitimate) user authenticates the SDK gcloud auth login on a different machine which should automatically re-add the Google Cloud SDK back to the account, but with different Oauth credentials .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.