By default GCP IAM service account keys never expire. Use Steampipe to find expiration dates and prioritize updates for better protection.