To set up Message Injection, the Google Workspace sync or uHealth with Google Workspace, you need a JSON key for a Google Cloud service account. When you try to create the key, Google may block you with a service account key creation is disabled error.
Newer Google Workspace tenants turn on an organisation policy by default that stops anyone creating service account keys. Even project Owners can't override it. You'll need to change the policy at organisation level before you can create the key.
In this article you will learn:
Why you're seeing this error
The error happens because the organisation policy constraint iam.disableServiceAccountKeyCreation is enforced in your Google Cloud environment. While it's enforced, nobody can create a new key for any service account. Even project Owners can't override it unless they have specific permissions at organisation level.
You'll see this error in the Keys tab of your service account after you click Add Key > Create new key.
Note: You make these changes at organisation level in Google Cloud, not inside your project. If you can't manage your Google Cloud organisation, ask someone who can to follow these steps.
Step 1: Assign the required role
In the top-left resource selector, select your Organization (not just an individual project)
Grant your user account the Organization Policy Administrator role
Note: Standard Owner roles do not have permission to change this policy.
Step 2: Modify the organisation policy
Go to the Google Cloud Organization Policies page
Make sure your organisation is selected in the top resource selector
Use the search bar to find the constraint
iam.disableServiceAccountKeyCreation(or search for Disable service account key creation)Click on the policy, then click Edit (or Manage Policy)
Change the enforcement setting from Enforced (On) to Not enforced (Off), or select Override parent's policy and turn the rule Off for your target scope
Click Save or Set Policy
Tip: Overriding the policy for your usecure project only keeps the rest of your organisation protected.
Step 3: Wait for propagation and retry
Wait a few minutes for the policy change to propagate across Google Cloud
Return to your service account in the console and try creating the key again (Keys tab > Add Key > Create new key > JSON > Create)
The JSON file will download to your computer. Keep it somewhere safe, then go back to the setup guide you were following to finish the setup.
Note: If you still see the error, wait a few more minutes and try again. Check that you changed the policy for the right organisation or project.
Turn the policy back on
Once you've created your key, we recommend turning the iam.disableServiceAccountKeyCreation policy back on so that nobody can create new keys. Follow Step 2 again and set the policy back to Enforced.
Turning the policy back on doesn't affect keys you've already created, so your usecure integration will keep working.
Note: If you need a new key later, for example to re-authorise an integration, you'll need to turn off the policy again first.