Service Accounts
Secure, programmatic identities for applications and services on Google Cloud.
What is Service Accounts?
A Service Account is a special type of Google account intended to represent non-human users that need to authenticate and be authorized to access data in Google Cloud. Unlike user accounts, which are intended for people, service accounts are designed for applications, virtual machines (VMs), and other services to securely interact with Google Cloud APIs and resources programmatically.
Service accounts are managed through Google Cloud Identity and Access Management (IAM). Each service account has a unique email address and can be assigned IAM roles to define its permissions. Service accounts can be used to run workloads on Compute Engine, Cloud Functions, or Kubernetes Engine, and are essential for automating cloud operations securely and efficiently.
Architecture
Key Components
Service Account Identity
A unique identity (email address) representing an application or VM, used to authenticate and authorize API requests within Google Cloud.
Service Account Keys
Cryptographic key pairs (private/public) used for authenticating service accounts outside Google Cloud or for programmatic access.
IAM Roles & Policies
Permissions and access controls assigned to service accounts, defining what resources and APIs they can access.
Key Capabilities
Programmatic Access
Enable secure, automated access to Google Cloud APIs and resources for applications and services.
Fine-Grained Permissions
Assign precise IAM roles to control exactly what resources and operations a service account can perform.
Key Management & Rotation
Support for secure key creation, management, and rotation to minimize security risks.
Delegation & Impersonation
Allow services to act on behalf of other identities or delegate limited permissions for specific tasks.
Common Use Cases
Related Topics
Test Your Knowledge
Score 8/10 or higher to pass
You need to be logged in to take this quiz.
Login to Continue