---
name: iam-sa-review
description: "Review service accounts in a GCP project. Use when you need to find unused service accounts, excessive roles, or user-managed keys. Usage: /iam-sa-review [PROJECT_ID]"
user_invocable: true
---

# /iam-sa-review — Review Service Accounts

Review all service accounts in a GCP project: identify unused SAs, excessive role grants, and user-managed key risks.

## Arguments

- `PROJECT_ID` (optional) — The GCP project to review. Falls back to `GCP_PROJECTS` env var or the current gcloud project.

## Steps

### 1. Resolve Project ID
```bash
echo "${GCP_PROJECTS:-$(gcloud config get-value project 2>/dev/null)}"
```

### 2. List Service Accounts
```bash
bash "${CLAUDE_PLUGIN_ROOT}/scripts/iam/list_service_accounts.sh" PROJECT_ID
```

### 3. Check Key Usage
```bash
bash "${CLAUDE_PLUGIN_ROOT}/scripts/iam/sa_key_usage.sh" PROJECT_ID
```

### 4. Analyze Results
Cross-reference the service account list with key usage data:
- **Stale SAs**: No key activity in 90+ days
- **Key risk**: User-managed keys older than 90 days (should be rotated)
- **Excessive roles**: SAs with Owner/Editor or multiple broad roles
- **Unused SAs**: SAs with no keys and no recent activity

### 5. Present Findings
Show a table of all service accounts with their key status, age, and last activity. Flag risky items and provide `gcloud` remediation commands (key rotation, SA disabling).