Configuring access and security · Topic 2 of 3
Service Accounts
Creating user-managed and Google-managed service accounts, granting minimum permissions, attaching them to resources, and controlling who can use a service account.
- 4 min
- Service accounts are identities for workloads: user-managed, default and service agents.
- Create one service account per app, with minimum roles on the narrowest resources.
- Attach with
--service-account; deployers needroles/iam.serviceAccountUser.
What it is
A service account is an identity for an application or workload rather than a person. Code running on a VM, in GKE or in Cloud Run uses a service account to call Google Cloud APIs. The exam covers creating service accounts (including Google-managed ones), granting minimum permissions, assigning them to resources and managing who can use them.
How it works
Types of service accounts
| Type | Created by | Example |
|---|---|---|
| User-managed service account | You | orders-app@shop-prod-1234.iam.gserviceaccount.com |
| Default service accounts | Google, when some services are enabled | The Compute Engine default service account PROJECT_NUMBER-compute@developer.gserviceaccount.com |
| Service agents (Google-managed service accounts) | Google, to let a service act on your resources | The Cloud Storage service agent used for CMEK; Cloud Build's service agent |
The Compute Engine default service account historically had the broad Editor role. Best practice is to create dedicated user-managed service accounts with only the roles each workload needs, and many organizations block automatic Editor grants with an organization policy.
Creating and granting minimum permissions
gcloud iam service-accounts create orders-app --display-name="Orders application"
# grant only what the app needs, on the narrowest resource
gcloud storage buckets add-iam-policy-binding gs://orders-uploads-1234 \
--member="serviceAccount:orders-app@shop-prod-1234.iam.gserviceaccount.com" \
--role="roles/storage.objectCreator"One service account per application (or per function) keeps permissions minimal and audit logs clear.
Assigning service accounts to resources
| Resource | How |
|---|---|
| Compute Engine VM | --service-account=SA_EMAIL --scopes=cloud-platform at creation; change it while the VM is stopped |
| Cloud Run service | gcloud run deploy ... --service-account=SA_EMAIL |
| Cloud Run functions | --service-account=SA_EMAIL at deploy |
| GKE workloads | Workload Identity Federation for GKE (next page) |
To attach a service account to a resource, the deployer needs the Service Account User role (roles/iam.serviceAccountUser) on that service account. This stops people from giving their code more power than they themselves have.
VM access scopes are a legacy limit on top of IAM. Use the cloud-platform scope and control access with IAM roles on the service account.
Managing a service account's own permissions
A service account is both an identity (it has roles on resources) and a resource (people have roles on it).
| Role on the service account | Allows |
|---|---|
Service Account User (roles/iam.serviceAccountUser) | Attach the service account to resources, so code runs as it |
Service Account Token Creator (roles/iam.serviceAccountTokenCreator) | Create tokens for it: impersonation |
Service Account Admin (roles/iam.serviceAccountAdmin) | Create and manage service accounts |
Service Account Key Admin (roles/iam.serviceAccountKeyAdmin) | Create and manage keys |
gcloud iam service-accounts add-iam-policy-binding \
orders-app@shop-prod-1234.iam.gserviceaccount.com \
--member="group:orders-devs@example.com" --role="roles/iam.serviceAccountUser"Service account keys
Downloadable JSON keys are long-lived secrets: if leaked, anyone can act as the service account. Avoid them where possible, block them with the organization policy iam.disableServiceAccountKeyCreation, and prefer attached service accounts, impersonation and Workload Identity Federation. If a key must exist, rotate it and store it securely.
A worked scenario
An orders application on Cloud Run must write uploads to one bucket and read one BigQuery dataset. The engineer creates a dedicated orders-app service account, grants roles/storage.objectCreator on the bucket and roles/bigquery.dataViewer on the dataset, deploys Cloud Run with --service-account, and gives the developers Service Account User on that service account so they can deploy it. No keys are created.
How the exam asks about this
- "Least privilege for an application on a VM." A dedicated service account with only the needed roles, attached to the VM.
- "Developers need to deploy VMs that run as a service account." Grant them Service Account User on that service account.
- "Stop anyone from creating service account keys." The organization policy disabling key creation.
- "Which identity does Google use to encrypt with my CMEK key?" The service agent for that service.
What to remember for the exam
- Service accounts are identities for workloads: user-managed, default and service agents.
- Create one service account per app, with minimum roles on the narrowest resources.
- Attach with
--service-account; deployers needroles/iam.serviceAccountUser. - Service accounts are also resources with their own IAM policy.
- Avoid downloadable keys; block them with an organization policy.
Using the Compute Engine default service account with Editor gives every VM broad access to the project. Replace it with dedicated service accounts.
Common mistakes
Sharing one service account across many apps. Permissions grow and audits blur.
Using access scopes as the main control. IAM roles are the real control.
Creating JSON keys for code running on Google Cloud. Attached service accounts need no keys.
Check yourself
Which role lets a user attach a service account to a VM or Cloud Run service?
Service Account User,
roles/iam.serviceAccountUser, on that service account.What are service agents?
Google-managed service accounts that let a Google service act on your resources.
Why should service account keys be avoided?
They are long-lived secrets; if leaked, anyone can act as the service account.
Topic 2 of 3 in Configuring access and security
Test yourself on Configuring access and security
The full Google Cloud Associate Cloud Engineer question bank has 661 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.