Developers use many service account keys. Requirement: all service accounts that need keys are created in project pj-sa, and keys must be valid for 1 day. Minimize cost and follow Google recommendations. What should you do?

The correct answer enforces two organization policies: one to set the maximum lifetime of service account keys to 24 hours, directly addressing the requirement for keys to be valid for 1 day. The second policy denies service account key creation except within pj-sa, ensuring all keys are created in the designated project. This approach leverages Google Cloud's native policy enforcement, which is a recommended security practice for managing service accounts and keys at scale, minimizing operational overhead and cost compared to custom automation solutions. The incorrect options propose custom automation (Cloud Run or Kubernetes CronJob) for key rotation, which is more complex and less aligned with Google's recommendation to use managed policies where possible. Additionally, disabling service account attachment or using a DENY policy over key lifetime are not the most precise or recommended methods for achieving the stated requirements.