No one should hold both Service Account Admin and Service Account User on the same scope

Service Account Admin can create and manage service accounts. Service Account User lets someone run workloads as a service account and so act with its permissions. One person with both can create an account, give it power and then use it, with no second person involved. Splitting the roles puts a second pair of eyes between creating an identity and using it.

Google documents these roles in Understanding roles: service account roles and recommends least privilege in Using IAM securely.

In the Google Cloud console open IAM & Admin, IAM, and filter the list for the roles Service Account Admin and Service Account User. Look for a member that appears under both.

This read-only command prints members and their roles for a project; it only reads the IAM policy:

gcloud projects get-iam-policy PROJECT_ID --format=json \
  | jq -r '.bindings[]
      | select(.role=="roles/iam.serviceAccountAdmin" or .role=="roles/iam.serviceAccountUser")
      | .role as $r | .members[] | "\(.)\t\($r)"' \
  | sort

Any member that appears on both role lines is a finding. Repeat for folders and the organization if you grant roles there.

Decide which of the two duties each person needs and remove the other. In the console: IAM & Admin, IAM, edit the member and delete one of the two roles. Grant service-account usage to the deployment pipeline or the owning team, and keep account administration with a small platform group.

gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="user:person@example.com" \
  --role="roles/iam.serviceAccountUser"

Better still, grant Service Account User on the single service account a person needs, not on the whole project. ConfigCobra only reports this finding; it never edits your IAM policy.

The person who loses a role can no longer do that half of the job. If they lose Service Account User, they cannot deploy or run workloads as those service accounts, and a deployment that depended on it will fail with a permission error. If they lose Service Account Admin, they cannot create or change service accounts.

Check who deploys with these accounts before removing a role, move that duty to the right team or pipeline first, and tell the affected people. Other users and running workloads are not touched.