# Error: Service account key limit exceeded. Maximum number of keys for service account: 10.

- **ID:** `policy/gcp-service-account-key-limit-exceeded`
- **Domain:** policy
- **Category:** resource_error
- **Error Code:** `QUOTA_EXCEEDED`
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

GCP enforces a hard limit of 10 user-managed keys per service account; attempting to create an 11th key fails.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| GCP IAM API v1 | active | — | — |
| gcloud CLI 400.0.0 | active | — | — |
| Google Cloud SDK 4.0.0 | active | — | — |

## Workarounds

1. **Delete unused keys using gcloud: `gcloud iam service-accounts keys list --iam-account=SA@PROJECT.iam.gserviceaccount.com` then `gcloud iam service-accounts keys delete KEY_ID --iam-account=SA@PROJECT.iam.gserviceaccount.com` to free up slots.** (95% success)
   ```
   Delete unused keys using gcloud: `gcloud iam service-accounts keys list --iam-account=SA@PROJECT.iam.gserviceaccount.com` then `gcloud iam service-accounts keys delete KEY_ID --iam-account=SA@PROJECT.iam.gserviceaccount.com` to free up slots.
   ```
2. **Use workload identity federation instead of service account keys for external workloads: configure a workload identity pool and provider.** (90% success)
   ```
   Use workload identity federation instead of service account keys for external workloads: configure a workload identity pool and provider.
   ```
3. **Create a new service account for additional workloads and assign the same roles.** (85% success)
   ```
   Create a new service account for additional workloads and assign the same roles.
   ```

## Dead Ends

- **** — The limit is per service account, not a global quota; deleting keys frees slots but recreating without cleanup still hits the limit if you exceed 10. (70% fail)
- **** — Reusing keys increases security risk and doesn't solve the underlying quota issue; you still need separate keys for different workloads. (60% fail)
- **** — This limit is not adjustable via quota increase requests; it's a hard platform limit that cannot be changed. (90% fail)