What are service accounts?
A service account is a special Google account that belongs to your application or a virtual machine (VM) instead of an individual end user. Your application uses the service account to call the Google API of a service, so that the users aren’t directly involved.
For example, a Compute Engine VM may run as a service account, and that account can be given permissions to access the resources it needs. This way the service account is the identity of the service, and the service account’s permissions control which resources the service can access.
A service account is identified by its email address, which is unique to the account.
Types of service accounts
User-managed service accounts
When you create a new Cloud project using Cloud Console and if Compute Engine API is enabled for your project, a Compute Engine Service account is created for you by default. It is identifiable using the email:
PROJECT_NUMBER-compute@developer.gserviceaccount.com
Google-managed service accounts
In addition to the user-managed service accounts, you might see some additional service accounts in your project’s IAM policy or in the Cloud Console. These service accounts are created and owned by Google. These accounts represent different Google services and each account is automatically granted IAM roles to access your Google Cloud project.
Google APIs service account
An example of a Google-managed service account is a Google API service account identifiable using the email:
PROJECT_NUMBER@cloudservices.gserviceaccount.com
This service account is designed specifically to run internal Google processes on your behalf and is not listed in the Service Accounts section of Cloud Console. By default, the account is automatically granted the project editor role on the project and is listed in the IAM section of Cloud Console. This service account is deleted only when the project is deleted.
Note: Google services rely on the account having access to your project, so you should not remove or change the service account’s role on your project.
When you create a new Cloud project, Google Cloud automatically creates one Compute Engine service account and one App Engine service account under that project.
Creating a service account
Creating a service account is similar to adding a member to your project, but the service account belongs to your applications rather than an individual end user.
To create a service account, run the following command in Cloud Shell:
gcloud iam service-accounts create my-sa-123 –display-name “my service account”
Granting roles to a service account for specific resources
gcloud projects add-iam-policy-binding $DEVSHELL_PROJECT_ID \
–member serviceAccount:my-sa-123@$DEVSHELL_PROJECT_ID.iam.gserviceaccount.com –role roles/editor