How to Create a Service Account in GCP

What is a Service Account?

A service account is a special type of Google account intended for non-human interaction. It is used by applications and virtual machines to authenticate and access Google Cloud services securely.

For example:

• A VM instance may use a service account to read data from Cloud Storage.
• An application running in Kubernetes might need to interact with Google Cloud APIs.
• Automation tools may use service accounts to schedule jobs or retrieve data.

Service accounts operate behind the scenes, acting as the identity of the application, enabling it to interact with APIs and services without manual login.

Why Use Service Accounts?

1. Automation
   Service accounts automate tasks by allowing apps and VMs to communicate with GCP services securely.
2. Security
   They ensure that applications have only the permissions required to perform their tasks, following the principle of least privilege.
3. Granular Access Control
   Service accounts enable administrators to grant and manage specific permissions through IAM (Identity and Access Management).
4. Non-Human Identity
   Since service accounts are not tied to humans, there is no risk of losing access if an employee leaves.
5. Audit and Monitoring
   All interactions by service accounts are logged in GCP’s audit logs, providing transparency and traceability.

How Service Accounts Work

When a service account interacts with GCP services, it uses cryptographic keys to authenticate itself. This key comes in the form of a JSON file, which is downloaded during service account creation.

The service account:

• Sends an authenticated request to Google Cloud services using the JSON key.
• Receives tokens that authorize its access to specific resources.
• Uses IAM permissions to determine what services or resources it can interact with.

Types of Service Accounts

1. User-Managed Service Accounts
   • Created and managed by users through the IAM console or gcloud CLI.
   • Can be assigned to VMs, applications, and services.
2. Google-Managed Service Accounts
   • Automatically created by GCP to run specific services like App Engine, Compute Engine, and Cloud Functions.
   • Users cannot delete these but can adjust their permissions.
3. Default Service Accounts
   • Created by default when you enable APIs like Compute Engine or App Engine.
   • Useful for quick start projects, but often have broader permissions.

Step-by-Step Guide How to Create a Service Account in GCP

1. Log in to Google Cloud Console

Visit the Google Cloud Console and log in with your credentials.

2. Access IAM & Admin

• Click the ☰ hamburger icon at the top left corner.
• Hover over IAM & Admin and select Service Accounts.

3. Create a New Service Account

• Click the + Create Service Account button at the top.

• Fill in the following details:
  • Service Account Name: Choose a descriptive name (e.g., my-app-service).
  • Service Account ID: Auto-generated but can be customized.
  • Description: Add a brief description of the account’s purpose.

• Click Create and Continue.

https://linuxcloudservers.com/wp-content/uploads/2024/12/s4.png

4. Assign IAM Roles

• Under Grant this Service Account Access, choose a role for the account:
  • Viewer – Read-only access.
  • Editor – Read and write access.
  • Owner – Full administrative access.
  • Or choose custom roles depending on your requirements.
• Click Continue.

For advanced monitoring, refer to the Site24x7 GCP permissions documentation.

5. Generate a JSON Key

• Click + Create Key under the service account details.

• Choose Key Type as JSON and click Create.

• The JSON key will automatically download to your device. Store this securely as it will be required for API authentication.

Verifying the Service Account

After creating the service account:

1. Return to the IAM & Admin → Service Accounts section.
2. Confirm the service account appears in the list.
3. Click on the service account to review assigned roles and generated keys.

Assigning Service Account to a Project

1. Go to IAM & Admin → IAM.
2. Click + Add to grant access to a project.
3. Enter the service account email.
4. Select the Viewer role or any other necessary permissions.
5. Click Save.

Assigning Service Accounts to Resources

1. VM Instances
   • When launching a VM, under the Management section, select the service account from the dropdown.
2. Cloud Functions
   • When creating a Cloud Function, select the service account under the Runtime Service Account option.
3. Kubernetes
   • Use Workload Identity to bind Kubernetes services to GCP service accounts securely.

Key Concepts to Understand

• IAM Roles and Permissions: Roles define what a service account can do. Permissions are bundled into roles.
• Key Management: A JSON private key is generated for each service account. This key is used for authentication.
• Principle of Least Privilege: Only grant the minimum permissions necessary for the service account to operate.
• Token Generation: Service accounts generate OAuth 2.0 tokens to authenticate and authorize API requests.

Common Use Cases for Service Accounts

1. Running Applications on Compute Engine
   Service accounts allow VM instances to securely access APIs and resources without user interaction.
2. Data Pipelines
   Use service accounts to move data between Cloud Storage, BigQuery, and external services.
3. CI/CD Pipelines
   Automate deployments and infrastructure provisioning using service accounts in pipelines.
4. Kubernetes Applications
   GKE (Google Kubernetes Engine) applications use service accounts to manage workloads that require API interaction.

Best Practices for Service Accounts

1. Follow Least Privilege
   Assign only the permissions necessary to avoid potential security vulnerabilities.
2. Rotate Keys Regularly
   Periodically generate new JSON keys to reduce exposure in case of key leakage.
3. Monitor and Audit
   Use Cloud Logging and Monitoring to track service account activity.
4. Restrict JSON Key Downloads
   Limit who can generate and download keys to reduce the risk of unauthorized use.
5. Delete Unused Service Accounts
   Regularly audit and remove unused service accounts to minimize security risks.

Conclusion

Service accounts in Google Cloud Platform are essential for securely automating interactions between applications and services. By creating and managing service accounts effectively, you can ensure seamless, secure operations while minimizing risks.

Following best practices and properly managing IAM roles ensures that your cloud environment remains secure and scalable. For more detailed information, visit the official GCP IAM documentation.