org-policy-deny-service-account-key-creation.log

Query: protoPayload.methodName: "google.iam.admin.v1.CreateServiceAccountKey"
Service account key creation denial:
{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "status": {
      "code": 9,
      "message": "Key creation is not allowed on this service account.",
      "details": [
        {
          "@type": "type.googleapis.com/google.rpc.PreconditionFailure",
          "violations": [
            {
              "type": "constraints/iam.disableServiceAccountKeyCreation",
              "subject": "projects/customer-monitoring-prod/serviceAccounts/106627732878159666173?configvalue=106627732878159666173",
              "description": "Key creation is not allowed on this service account."
            }
          ]
        }
      ]
    },
    "authenticationInfo": {
      "principalEmail": "user@domain.com",
      "principalSubject": "user:user@domain.com"
    },
    "requestMetadata": {
      "callerIp": "8.8.8.8",
      "callerSuppliedUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36,gzip(gfe)",
      "requestAttributes": {
        "time": "2021-09-13T03:14:32.392272964Z",
        "auth": {}
      },
      "destinationAttributes": {}
    },
    "serviceName": "iam.googleapis.com",
    "methodName": "google.iam.admin.v1.CreateServiceAccountKey",
    "authorizationInfo": [
      {
        "resource": "projects/-/serviceAccounts/106627732878159666173",
        "permission": "iam.serviceAccountKeys.create",
        "granted": true,
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/106627732878159666173"
        }
      }
    ],
    "resourceName": "projects/-/serviceAccounts/106627732878159666173",
    "request": {
      "name": "projects/customer-monitoring-prod/serviceAccounts/106627732878159666173",
      "@type": "type.googleapis.com/google.iam.admin.v1.CreateServiceAccountKeyRequest",
      "private_key_type": 2
    },
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ServiceAccountKey"
    }
  },
  "insertId": "1kmaz5nf159nie",
  "resource": {
    "type": "service_account",
    "labels": {
      "project_id": "customer-monitoring-prod",
      "unique_id": "106627732878159666173",
      "email_id": "domain-pub-sub@customer-monitoring-prod.iam.gserviceaccount.com"
    }
  },
  "timestamp": "2021-09-13T03:14:32.382833870Z",
  "severity": "ERROR",
  "logName": "projects/customer-monitoring-prod/logs/cloudaudit.googleapis.com%2Factivity",
  "receiveTimestamp": "2021-09-13T03:14:33.269115331Z"
}