40 Cloud session control + admin re-auth

draft

Google Cloud sessions — the Cloud Console and gcloud/Cloud SDK — carry their own session policy, entirely separate from the Workspace web session. New Google Cloud customers get a 16-hour session length enforced by default, but older organizations may default to never requiring reauthentication — there, a stolen laptop or an exfiltrated token keeps working indefinitely. This forces re-authentication on a short timer (1 hour is the floor, 24 hours the ceiling), and the method matters: a password re-auth is defeated by a phished credential, a security key is not.

Documentation: Set session length for Google Cloud services · Best practices for mitigating compromised OAuth tokens for Google Cloud CLI

Caveats

This governs the Google Cloud console, gcloud, and any third-party or internal app requesting Google Cloud scopes (apps marked Trusted can be exempted via ‘Exempt trusted apps’) — but not the Google Cloud console mobile app. The Workspace web session is a different setting (№12), and setting one while assuming both are covered is the classic mistake.
Service accounts and long-lived OAuth refresh tokens are not subject to session control — automation keeps working after the human session expires, which is the point and also the gap.
Reauthentication is not re-authorization — an already-open gcloud operation continues to completion.

Setup steps

Select the admin/privileged OU (organizational unit), then require reauthentication rather than leaving the session length at its default.

open ↗

https://admin.google.com/ac/security/reauth/admin-tools · captured 2026-07-15

Security › Access and data control › Google Cloud session control

Reauthentication policy

Require reauthentication
Set the reauthentication frequency to the shortest value the admins will tolerate (1 hour is the floor; 24 hours is the ceiling).

Security › Access and data control › Google Cloud session control

Reauthentication frequency

1 hour
Choose the reauthentication method — password alone lets a phished credential re-open the session; the security key path does not.

Security › Access and data control › Google Cloud session control

Reauthentication method

Security key (where FIDO2 is deployed) rather than Password

How to verify

Leave a gcloud/console session past the configured window, then run any privileged command — it must demand re-authentication.
```
gcloud projects list  # after expiry: prompts for reauth
```

draft v0.0.3 Prevent policy #3 · #29 ↗