# 错误：服务账号密钥超出限制。每个服务账号最多允许10个密钥。

- **ID:** `policy/gcp-service-account-key-limit-exceeded`
- **领域:** policy
- **类别:** resource_error
- **错误码:** `QUOTA_EXCEEDED`
- **验证级别:** ai_generated
- **修复率:** 85%

## 根因

GCP 对每个服务账号强制执行10个用户管理密钥的硬性限制；尝试创建第11个密钥会失败。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| GCP IAM API v1 | active | — | — |
| gcloud CLI 400.0.0 | active | — | — |
| Google Cloud SDK 4.0.0 | active | — | — |

## 解决方案

1. ```
   使用 gcloud 删除未使用的密钥：`gcloud iam service-accounts keys list --iam-account=SA@PROJECT.iam.gserviceaccount.com` 然后 `gcloud iam service-accounts keys delete KEY_ID --iam-account=SA@PROJECT.iam.gserviceaccount.com` 以释放槽位。
   ```
2. ```
   对于外部工作负载，使用工作负载身份联合而不是服务账号密钥：配置工作负载身份池和提供程序。
   ```
3. ```
   为额外的工作负载创建一个新的服务账号并分配相同的角色。
   ```

## 无效尝试

- **** — The limit is per service account, not a global quota; deleting keys frees slots but recreating without cleanup still hits the limit if you exceed 10. (70% 失败率)
- **** — Reusing keys increases security risk and doesn't solve the underlying quota issue; you still need separate keys for different workloads. (60% 失败率)
- **** — This limit is not adjustable via quota increase requests; it's a hard platform limit that cannot be changed. (90% 失败率)