I have a requirement where I want to restrict certain service account from creating key (json/yaml file) but that restriction should only affect specific service account in a specific project which belongs to an organization.
I did go through the following documentation, but It did not match the requirement of restricting only certain service account rather than all service account in that particular organization.
As far as I know, you can only restrict key creation on project level.
Based on you configuration, in may be viable to restrict user's access to a Service Account - link.
Another workaround would be to split your resources into smaller projects, so that they are easier to manage.
If you think that policy restricting key creation for only selected service accounts should be available, you can file a Feature Request on Google Public Issue Tracker.
